Fleet, open‑source device‑management software, suffers a functional flaw in Windows MDM command processing that lets a malicious device read MDM commands intended for other devices. The exposed data can include Wi‑Fi credentials, VPN secrets, and certificate payloads, exposing critical configuration information that could be used to compromise other machines or services.

The vulnerability affects all installations of Fleet before version 4.81.1. Users running the open‑source Fleet distribution with a Windows fleet should verify their current version and plan an upgrade if necessary.

The CVSS score of 6.6 indicates moderate severity. No EPSS score is available, and the CVE is not yet listed in the KEV catalog. The likely attack vector requires an attacker to have a device enrolled in the Fleet deployment; once that condition is met, the device can request and receive MDM commands for other devices. Because the command disclosure can expose confidential configuration data, the potential impact on confidentiality is significant. Overall risk is moderate to high depending on the sensitivity of the data exposed.