Fleet Open-Source Platform Critical SQL Injection and DoS Vulnerabilities

CERT-Bund disclosed multiple critical vulnerabilities (advisory WID-SEC-2026-0902) in Fleet open-source device management platform versions below 4.81.1. Affected systems running Linux or UNIX can be exploited via remote attack to execute SQL injection, cause denial of service, bypass security controls, disclose sensitive information, and execute arbitrary code with administrator privileges. CVSS Base Score is 9.8 (critical) with Temporal Score of 8.5 (high).

Organizations using Fleet must immediately identify any affected deployments and upgrade to version 4.81.1 or later. No formal compliance deadline is specified; however, immediate patching is strongly recommended given the critical severity and active exploit potential. Monitor for indicators of compromise and apply mitigations as referenced in the advisory. The vulnerability IDs and additional technical details are linked through the provided CVE and information references.