Fleet, an open‑source device management platform, contained a flaw in its Android Mobile Device Management Pub/Sub handling that allows an unauthenticated attacker to trigger a device unenrollment event. The vulnerability does not grant access to Fleet, execution of commands, or visibility into device data, but it can remove a target Android device from management, disrupting its administration and any remote policies applied to it.

The issue applies to the fleetdm fleet product in all versions older than 4.80.1. Android devices managed through Fleet’s MDM feature are the relevant scope. Versions 4.80.1 and newer contain the fix.

The CVSS score of 1.7 and an EPSS score less than 1 % indicate a low threat level and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires no authentication or privilege and simply causes a single managed device to be removed from administration, offering no broader system compromise.