Fleet, an open‑source device‑management platform, contains a flaw in its Windows MDM command processor that permits a malicious device enrolled in a fleet to read commands meant for other devices. The result is an unauthorized disclosure of sensitive configuration information—including Wi‑Fi credentials, VPN secrets, and certificate payloads—across the entire Windows fleet.

The issue affects Fleet deployments of any version earlier than 4.81.1, impacting all Windows endpoints managed by Fleet on those installations. The vendor identifies the problem as CWE‑488, Information Exposure After Error.

The vulnerability is scored 6.6 on CVSS, indicating moderate severity, and has an EPSS score of less than 1 %, suggesting low exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation requires control over an enrolled device, meaning the attack vector is internal; an attacker would need to enroll a device that can query the MDM command service and obtain data for other devices. Because no public exploit is documented, the risk is lower than for publicly exploited flaws, but the potential for hidden data leakage across a fleet remains significant if an attacker gains device foothold.