Fleet, an open source device management software, had a security vulnerability (CVE-2026-23998) in its Windows MDM management endpoint prior to version 4.81.0. The endpoint relies on mutual TLS client certificates for device authentication, but due to improper certificate validation, requests lacking client certificates could be mistakenly accepted as trusted. This allowed attackers with prior knowledge of a valid enrolled device identifier to impersonate that device and access sensitive configuration payloads delivered via MDM profiles. The vulnerability is limited to the targeted Windows device and does not affect Fleet’s control plane or allow administrative access. The issue is addressed in Fleet version 4.81.0.

An attacker who knows a valid enrolled Windows device identifier can impersonate that device to retrieve sensitive configuration data such as Wi-Fi and VPN configurations, certificates, and other secrets delivered through MDM profiles. This exposure is limited to the targeted device and does not enable enrollment of new devices, administrative access, or compromise of the Fleet control plane. The CVSS 4.0 score is 8.2, indicating a high severity vulnerability with network attack vector and high impact on confidentiality.

Fleet version 4.81.0 contains a patch that fixes this vulnerability and should be applied to affected systems. If upgrading immediately is not possible, users should temporarily disable the Windows MDM functionality to prevent exploitation. There is no indication that other mitigations or workarounds are available or recommended.