Fleet

Fleet 4.90.0 (Aug 05, 2026)

IT Admins

• Added the ability to upload multiple custom packages (up to 10) for the same software title on a team, so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. When a host matches more than one package, the first-added package is installed.
• Added support for editing existing configuration profiles (Apple .mobileconfig, Apple DDM declarations, Windows, and Android) in place via PATCH /api/v1/fleet/configuration_profiles/:profile_uuid.
• Added custom host vitals: admins can define custom host fields, set their values per host manually or via the API, and reference them as $FLEET_HOST_VITAL_<id> variables in scripts and configuration profiles.
• Added the ability to enforce a host naming template on macOS, iOS, and iPadOS hosts under Controls > OS settings > Host names, for a fleet or for "No team" (Fleet Premium).
• Added POST /api/v1/fleet/host_name_template to set or clear the naming template (fleet_id omitted or 0 targets "No team"); an empty template clears it without renaming any host.
• Added a name_template key under controls in GitOps for fleets and "No team", and included it in fleetctl generate-gitops output.
• Added a "Host name" row with enforcement status (Enforcing, Verifying, Verified, Failed) to the host details OS settings modal, including a resend action via POST /api/v1/fleet/hosts/{id}/name_template/resend.
• Added host name enforcement statuses to the Controls OS settings aggregate cards and the os_settings host filter.
• Added the edited_host_name_template activity.
• Added support for Python (.py) script-only software packages, which can be uploaded as custom packages (the file contents become the install script) and installed on macOS and Linux hosts, via the UI, REST API, and GitOps.
• Added support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via the Fleet Desktop app on macOS 26+ hosts.
• Added UI for configuring Apple account provisioning (FPSSO) in the integrations settings.
• Enabled Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously available only on Fleet Cloud). The microsoft_compliance_partner.proxy_api_key server configuration has been removed; the feature is now gated on the Fleet Premium license tier.
• Added native Splunk HEC log destination for osquery status, result, and audit logs.
• Added support for escrowing disk encryption recovery keys from Linux hosts that use TPM-backed full-disk encryption (e.g. Ubuntu 26). On these hosts, orbit escrows a dedicated Fleet-owned snapd recovery key silently, without prompting the end user for a passphrase.
• Added FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION (mdm.enable_custom_disk_encryption) as a cross-platform alias for FLEET_MDM_ENABLE_CUSTOM_FILEVAULT. When set, it allows both custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.
• Enabled "Turn off MDM" button for offline macOS hosts. The unenroll command is now queued and delivered when the device comes back online, consistent with iOS/iPadOS behavior.
• Added enrollment profile URL to the macOS tab in the "Add hosts" modal, with enrollment type selection (company-owned or personal/BYOD) for MDM users.
• Added support for targeting declarations to the user channel on macOS.
• Added the ability to handle DDM assets, and unblocked more declaration types.
• Added the certificates list to the host details page for Windows hosts, showing each certificate's scope (System or User). This requires osquery 5.23.1 or higher on the host.
• Added a "View certificate" modal to Controls > OS settings > Certificates so admins can inspect and copy an existing certificate's details.
• Surfaced hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.
• Added "Targeted platforms" column and platform filter dropdown to the Policies page.
• Added optional platform query parameter to GET /api/v1/fleet/policies and GET /api/v1/fleet/fleets/{id}/policies to filter policies by targeted platform.
• Added public IP address to host search, so that searching by IP now matches both the primary (private) IP and the public IP.
• Added Zorin OS as a recognized Linux platform. Hosts running Zorin OS now enroll with platform=zorin, appear in the Linux disk-encryption summary, support .deb software installs, can be targeted by label platform filters, and have CVEs matched against the underlying Ubuntu LTS OVAL feed (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Unknown future Zorin versions fall through to an unsupported platform string so vulnerability scanning is skipped rather than served stale data from an aging LTS feed.
• Added support for CachyOS (an Arch-based Linux distribution) as a recognized Linux platform.
• Added an "Operating systems" card to the dashboard when Linux or Android is selected.
• Added installed version and available version columns to the self-service software table on the My device page.
• Added the "Applications" / "Full inventory" software filter to the Fleet Desktop My device > Software tab for macOS hosts, matching the host details page.
• Added the asynchronous live query endpoint (POST /api/v1/fleet/reports/run) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.
• Added audit activities when secret variables are created or updated through the PUT /api/latest/fleet/spec/secret_variables endpoint.

Security Engineers

• Added vulnerability (CVE) reporting for Android OS versions on the Software > OS page, where Android previously showed as "Not supported."
• Folded the Android security patch level into the host's OS version so Android versions read as "Android 16 (2026-05-01)", giving vulnerability-relevant granularity per patch level.
• Updated CIS Benchmark policies for Windows 10 Enterprise to align with the CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 (added, removed, and updated policies per the v4.0.0 change history).
• Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add $FLEET_VAR_CERTIFICATE_RENEWAL_ID to the certificate's Subject OU to enable.
• Renamed $FLEET_VAR_SCEP_RENEWAL_ID to $FLEET_VAR_CERTIFICATE_RENEWAL_ID. The legacy name still works.
• Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.
• Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).
• Removed the validation, added in Fleet 4.89.0, that rejected custom SCEP proxy certificate authority challenges containing characters outside the ASN.1 PrintableString set (for example, an underscore). Apple devices can enroll certificates using such challenges, so they are accepted again. A fix for Windows certificate enrollment failing with these challenges will ship separately.
• Rejected empty and whitespace-only enroll secrets when creating or updating teams.
• Restricted SCIM endpoint access to global admin users only.
• Removed the unused /api/mdm/microsoft/auth Windows MDM STS endpoint. Fleet always advertises the OnPremise auth policy, so no device ever contacted this endpoint. It now returns a 404. Windows MDM enrollment (Autopilot, Settings app, and fleetd-initiated) is unaffected.
• Added a server_bypass_network_blocking server config option to allow disabling all outbound network blocking protections for integration HTTP requests in production, for environments where egress is already constrained by external infrastructure.

Bug fixes and improvements

• Improved software ingestion performance by removing a full table scan of software_titles table.
• Optimized memory usage of CVE chart cron job.
• Reduced MySQL reader load when listing hosts with device_mapping=true and a search query by evaluating device mapping as a per-row correlated subquery instead of a fully-materialized derived-table join, and by skipping it entirely in the host count query.
• Improved the performance of Windows MDM profile installation across large numbers of hosts by reducing database lock contention when recording command results.
• Improved performance of Orbit config endpoint by batching extension label-membership checks into a single database query.
• Improved performance of host config endpoint by caching scheduled query configuration.
• Improved efficiency of the scheduled query stats aggregation cron job.
• Added better indexing for the Get Next Apple MDM command query.
• Added a long-lived immutable Cache-Control header to content-hashed static assets under /assets/ so browsers and CDNs can cache them across loads instead of refetching the JS/CSS bundle from origin every time.
• Removed the fleetdm/bomutils Docker dependency for generating macOS .pkg fleetd installers; the Bill of Materials and xar archive are now written by pure-Go code, so fleetctl package --type pkg no longer requires Docker, mkbom, or xar.
• Updated the Render deployment blueprint to use MySQL 8.0.44 (previously 8.0.24), fixing an "Error 1235 ... nesting of unions at the right-hand side" error on Render deployments.
• Improved GitOps consistency by validating batch-applied Windows configuration profiles against the server's current MDM configuration state, while continuing to support previewing (dry run) a config that enables Windows MDM and applies profiles in a single run.
• Added a check for duplicate patch policies when applying GitOps.
• Added an error when fleet_maintained_app_slug is set on a non-patch policy in a GitOps yaml file.
• Surfaced a more detailed error message in GitOps if user doesn't have server_private_key configured.
• Improved error message when a mobileconfig profile contains unescaped special characters (e.g. &, <, ', >) that cause illegal base64 data errors during plist parsing.
• Updated the invalid NDES admin credentials SCEP error message to point to the correct UI location (Settings > Integrations > Certificate enrollment).
• Improved the Windows MDM enrollment server log for unsupported username and password (OnPremise) enrollment: a device that is not joined to Microsoft Entra ID now receives a clear server log message to join Microsoft Entra ID or enroll with fleetd.
• Added anonymous usage statistics reporting the number of macOS and Windows hosts enrolled in Fleet's MDM.
• Renamed "Create" buttons and links to "Add" across the Fleet UI for consistency.
• Updated link styles in the UI.
• Updated the 404 page with a new illustration and copy consistent with the rest of the app.
• Updated the 500 and 403 error pages to match the design system and reuse the app navigation so the 500 page no longer shows broken image elements.
• Improved the user menu to show individual settings sections for admins.
• Updated Windows MDM end user experience radio button labels from Automatic/Manual to Fleet agent-driven/End user-driven to reduce confusion with MDM status terminology.
• Updated relative "time ago" timestamps to show days instead of months when the timestamp is less than 90 days ago.
• Updated the message shown when refetching a host's vitals takes longer than expected to reflect uncertainty rather than failure, on the host details page, the My device page, and the dashboard's "Welcome to Fleet" card.
• Clarified the delayed host vitals refetch banner to reflect that a refetch was sent and the UI will update when the host responds.
• Removed the default platform filter on the "hosts online" chart, so iOS, iPadOS, and Android hosts are now included by default alongside desktop platforms.
• Removed the elevated white background container from the loading spinner for a flatter, more consistent look.
• Removed the blue active-state background flash when clicking a row in a single-select data table (e.g., My device > Policies).
• Updated missed ABM references to AB.
• Hid the Self-service "Install all" button on the unfiltered "All" category so end users can't queue an install of the entire catalog in one click. The button still appears when a specific category is selected.
• Hid self-service categories that have no available software from the category filter on the My device page, so users only see categories they can actually install from.
• Added a "no custom SCEP CA configured" empty state to the certificates card.
• Made form validation consistent across more forms (#40410 follow-up): validation errors now appear when leaving a field (on blur) and no longer appear before any input. This covers the policy automations "Other workflows" Destination URL, the add/edit user Email field, and the host status webhook Destination URL (both global settings and fleet settings).
• Fixed recurring Redis MOVED errors and silently-dropped report result-count increments on Redis Cluster deployments by grouping query_results_count keys by hash slot before pipelining.
• Fixed newly created or updated reports not appearing in the host details "Live report" modal or the reports list until a hard refresh.
• Fixed an issue where an identity provider (IdP) user associated with multiple hosts only had IdP host vitals populated on one of them. All matching hosts are now linked when the SCIM/IdP user is created.
• Fixed a bug where the Add software > App Store picker failed with an error for maintainer and technician roles because listing VPP tokens required admin access.
• Fixed an issue where the tooltip size of "Require BitLocker PIN" was bigger than normal.
• Fixed a bug where the DEP syncer could silently drop device enrollment events when interrupted mid-run (e.g. context cancelled). The sync cursor now only advances after device records are successfully written, ensuring affected devices are replayed on the next sync rather than lost.
• Fixed high memory usage (and occasional osquery watchdog worker restarts) on macOS hosts running the software_macos detail query, caused by an unbounded recursive filesystem walk used to de-duplicate Homebrew casks against the apps table. The check now uses bounded, non-recursive globs matching the standard cask layout. This also fixes casks that ship no .app bundle (e.g. gcloud-cli) being incorrectly dropped from software inventory.
• Fixed the "Missing hosts" summary card not showing on the Fleet Free dashboard when a platform other than "All" was selected.
• Fixed an issue where ACME urls would throw a 500 error on malformed URLs.
• Fixed macOS software titles being displayed with an embedded login-helper's name (e.g. "AmphetamineLoginHelper") instead of the parent app's name when the helper bundle shares a bundle identifier with the main app. Embedded .app bundles nested under Contents/ are now excluded at ingestion, and existing mis-named titles are renamed by a one-shot migration that recomputes the name from the title's sibling software rows.
• Fixed long certificate names overflowing the delete certificate modal in Controls > OS settings > Certificates.
• Fixed the policies and users tables intermittently reloading and clearing the current selection or resetting to the first page when the browser window regained focus.
• Fixed a timeout when editing existing Windows configuration profiles for a large team via POST /api/latest/fleet/mdm/profiles/batch (GitOps). Now the request stays fast regardless of host count.
• Fixed label membership being incorrectly cleared when a label's query errors out on a host (e.g. the extension socket is unavailable) instead of returning zero rows; existing membership is now left unchanged when a label query fails.
• Fixed observers not seeing the "Show managed account" action on a macOS host's details page, even though the API already allows them to view the managed local account password.
• Fixed an issue where the truncated vulnerabilities list in the Update details modal did not show a tooltip listing the remaining CVEs.
• Fixed an incorrect error message where an msix file was parsed as an ipa file.
• Fixed sorting of fleets for fleet-level users.
• Fixed stale policy results inflating a host's failing policies count (shown in Fleet Desktop and the host's "Issues" column) after the policy no longer applied to the host (e.g. the host changed teams, or the policy's platform or label scope changed). Stale results are now cleaned up when the host reports its policy results.
• Fixed missing hover state on buttons and dropdowns inside cards in dark mode.
• Fixed the Policies page automations filter disappearing from the UI when switching to the "Unassigned" fleet and selecting a different automation type.
• Fixed the SSO sign-on button text overflowing by using a fixed "Sign in with SSO" label and showing the configured IdP name in a tooltip.
• Fixed an issue where premium MDM calls were being made on a Fleet Free license.
• Fixed cron jobs getting stuck in "expired" when a run is interrupted mid-flight (e.g. during server shutdown); the run now records a terminal "canceled" status, preserving any job errors, instead of being left "pending" until reaped to "expired".
• Fixed several styling issues on the end user enrollment page (BYOD info banner icon, active tab color, banner border, uneven QR code spacing) and added a "Learn more" link to the BYOD info banner. Also fixed enroll secret text incorrectly rendering in blue instead of black in the Add hosts modal.
• Fixed error in re-enrollment to Fleet with EUA on Linux with a different e-mail than the one used in the first enrollment.
• Fixed the vulnerability automations webhook "Destination URL" field to validate on blur (when the user clicks out of the field), consistent with other URL fields in Fleet, instead of only showing an error on save.
• Fixed Google Translate extension causing a 500-page when running live reports.
• Fixed a bug where some symbols changed height based on nearby characters in input fields.
• Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.
• Fixed an issue where tooltips for full name did not always show.
• Fixed server-side paginated tables (e.g. policies) landing on an empty state after deleting the last row on a page. The table now navigates back to a page with data instead.
• Fixed a server panic ("assignment to entry in nil map") when a host checked in for its osquery config while its agent options had a null config.
• Fixed team write endpoints (modify team, modify team agent options, and create team) so that they no longer return plaintext enroll secrets to users who cannot read them (such as GitOps), and applied the same secret masking to the list teams response.
• Fixed a bug where a custom Windows configuration profile/command could bypass Fleet's checks by using a scope-less LocURI.
• Fixed vulnerability detection for Citrix Workspace on Windows by normalizing the software version (e.g. 25.7.1.6 to 2507.1.6) for Citrix Workspace entries whose name does not include the YYMM release, so the generated CPE matches NVD.
• Fixed Citrix Workspace LTSR detection on Windows to include cumulative updates (e.g. 2203 LTSR CU4), so their vulnerabilities report the correct LTSR resolved_in_version (e.g. 2402 for CVE-2024-6286) instead of the Current Release version.
• Fixed missing resolved_in_version for CVE-2025-63389 on Ollama (resolved in v0.12.4), which was absent because the NVD record only provides a versionEndIncluding constraint.
• Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.58.0
2. fleet-desktop-v1.58.0 (included with Orbit)
3. osquery-5.23.1 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.5.0

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f70530247af40cdb7a240d5586a9c1403e0b950934f6f60e9d959c28380670fc  fleet_v4.90.0_linux.tar.gz
72702a57e26c0440143592a248767d323d61a26a7f9e1f1250dbf6f94803c59a  fleetctl_v4.90.0_linux_amd64.tar.gz
19b300688019fc13d3566aee1bb1f3d40d5a9287d5d83be17dd947201bd91bea  fleetctl_v4.90.0_linux_amd64.zip
47d78cae6a424c821f1de93731c5fd33c29ad8e4d3eda5df3baaaf24416241c7  fleetctl_v4.90.0_linux_arm64.tar.gz
7fa247777fc5b9ccbec6aea1831c4375eb6e78e9e1f56ae29d86b7a17d59ef27  fleetctl_v4.90.0_linux_arm64.zip
02e171f89d8146c5f732b9f1b3569a9acbf874db89fff063d3cc82de9b5bcd6c  fleetctl_v4.90.0_macos.tar.gz
95e89e3ca10b1f72946bfa11b5ba0b7fa591d896504916038299ec716df6d8b8  fleetctl_v4.90.0_macos.zip
7cd9a81227e1a3dda0fd717dc8eb9f23101fe50d18218287ff0cee32f52db53d  fleetctl_v4.90.0_windows_amd64.tar.gz
886bc083dbb682777886df3246529fe88c2736b626cfbc85886153d2306e441f  fleetctl_v4.90.0_windows_amd64.zip
a38f591c4fe1758e741bca9823f548dfb8700b2ca3b319ba3bfa35d77c3f72cf  fleetctl_v4.90.0_windows_arm64.tar.gz
6e12b641986e98551b5c6ec689e45fa77599228a99ec06d2f52431035d5aceaa  fleetctl_v4.90.0_windows_arm64.zip

Bug fixes

• Fixed a bug where a failed software install was reported as successfully installed when the install script exited with an error but a post-install script exited successfully.
• Fixed Windows Autopilot enrollments intermittently hanging on the Enrollment Status Page at "Account setup".
• Fixed an issue where devices given a mandatory update during ADE enrollment might display a failure or fail to display the update
• Fixed a bug where adding Windows software via GitOps could create a duplicate software title when a host had already reported the same program.
• Fixed a bug where Apple MDM devices re-enrolling manually with a pending SCEP renewal would not be treated as a new renewal and might skip apps, profiles, etc
• Fixed a bug where a Fleet-maintained app install could run a stale, previously-cached version after the app was auto-updated; installs (including automatic retries) now target the version Fleet currently displays.
• Fixed a bug where pinning a Fleet-maintained app to a different version didn't update the patch policy for it.

Upgrading

Please note this upgrade has an elevated migration time for a one time table rebuild that could take up to 30m

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

6939f39a5a3290e9254b8dd030e48ebe34eb1ca757f84c252116cece082a2bb7  fleet_v4.89.2_linux.tar.gz
a60f0bdef6940a97500f589221c037400ae2827ffecadd86a6de9185a6366306  fleetctl_v4.89.2_linux_amd64.tar.gz
7753dbdca016bb68d5f2b8975902c8f1dc3677ad3aa33a8d6421bdaac6123202  fleetctl_v4.89.2_linux_amd64.zip
d7e463a015beb0c22818b96284bcef017737fa3b1a2a5b983af22c37638d1e10  fleetctl_v4.89.2_linux_arm64.tar.gz
2d4e9e3099ef5d7986771c8050175d7f5110020646b41df91d13f4e62b556a77  fleetctl_v4.89.2_linux_arm64.zip
38222bb2a5cb010e3de1337e6cd500a4d8773f68da1f74696850ed4ec1b18270  fleetctl_v4.89.2_macos.tar.gz
2b458368f444f8b352a42afd3b16e37085a9bcc6262800523e0d6c0337805644  fleetctl_v4.89.2_macos.zip
aa5d5083b94cc0bf166e70a01a62604f1a48554a2dfd2d88f4c7d09f0db2d904  fleetctl_v4.89.2_windows_amd64.tar.gz
89fb65ea511a49b85331ee74b1b1acc029750f85eb1972115c5fbbe23c65a775  fleetctl_v4.89.2_windows_amd64.zip
a36936f41280ff13c8c2364254b57d2fb08f6888626cd01e1e700c429d55d37d  fleetctl_v4.89.2_windows_arm64.tar.gz
9d5ac115c810d8a9db30254e3bfb1362e5549a21c27114217032d224c3947a73  fleetctl_v4.89.2_windows_arm64.zip

Bug fixes

• Fixed a bug where fresh Windows 11 25H2 (and other recent builds) failed MDM enrollment with error 80180006 because the device's discovery RequestVersion (e.g. "9.0") was rejected by an exact-match allow-list. Fleet now accepts any MS-MDE2 discovery RequestVersion at or above the minimum supported version ("4.0").

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

72fb53b632048d94a475082050a3fb9ee147c120b90b4bd03407668b0643eb2f  fleet_v4.89.1_linux.tar.gz
5fdccf39237db3c96fa69468539e22c2cd69cfff5a4b147fdbcb5ca22ea1f2be  fleetctl_v4.89.1_linux_amd64.tar.gz
7a2316437e9183cfaf1b18047df6245e8a88b338f8879fbe2ebaf06a39a00cda  fleetctl_v4.89.1_linux_amd64.zip
ff6e4225004fb2db43d5f1f178ea780d82db0925258015a67379d52056aed092  fleetctl_v4.89.1_linux_arm64.tar.gz
62617b3fec54ccf4d458b1f69ab0d82b91299594e802c9d27f5e3ce61789d5f2  fleetctl_v4.89.1_linux_arm64.zip
a13f88800e59792af3480feb1ac0e6fe4f63775e87f237b5a47264a5e05f85e6  fleetctl_v4.89.1_macos.tar.gz
faee6f1383eb9c745c8d225e2d8972b5c51c89b86db68da14e1cc84c641722ba  fleetctl_v4.89.1_macos.zip
e57afa95adbb86592495583fb61f6669d40629dd8ee16aebce426ab3443580c2  fleetctl_v4.89.1_windows_amd64.tar.gz
1d9a5a250d5367a8252a3eefc016c3d83edfb5a1ef795809a215f6ad84df5948  fleetctl_v4.89.1_windows_amd64.zip
39d7a5b4fe7533cb696bb6de6da42928801f96315bb98719d9225add5d650263  fleetctl_v4.89.1_windows_arm64.tar.gz
df97595ce284ccb1ff86e27644ad337ed34af17b12350cefd12a0d4654ec7eb4  fleetctl_v4.89.1_windows_arm64.zip

Fleet 4.89.0 (Jul 15, 2026)

IT Admins

• Added the ability to target a policy to hosts using a combination of "include" and "exclude" labels.
• Added the ability to run a policy check before installing Windows and Linux setup experience software. When a team policy's install-software automation points at a setup experience installer, Fleet runs that policy during setup and skips the install when it passes (the software is already installed and up to date), speeding up the end user setup experience. When the policy fails, the software is installed as part of setup experience.
• Changed calendar remediation events to be scheduled on the next business day (skipping weekends) after a policy failure, instead of always being scheduled on the next Tuesday.
• Updated policy details page to show automations and labels as a single property. Also changed the layout of policy properties.
• Added automation runs table to the policy details page, showing per-host automation outcomes with filtering, search, and a reset policy action.
• Added per-host activity log entries when policy automations (webhook, tickets, Google Calendar, and Microsoft conditional access) fail or succeed.
• Added POST /api/v1/fleet/policies/:policy_id/reset endpoint to reset a policy's pass/fail results, clearing counts and membership immediately.
• Added GET /api/v1/fleet/policies/:id/automation_activities endpoint to list automation activities for a policy.
• Added the ability to keep Fleet-maintained apps automatically updated to the latest version, pin them to a specific version or major version, or roll back to a previously cached version, from the UI and via GitOps (Fleet Premium).
• Surfaced .sh script-only software packages on the macOS tab of Controls > Setup experience > Install software, with selections tracked independently from the Linux tab.
• Added setup_experience_platform on software packages in GitOps YAML so .sh script-only installers can be selected for the macOS setup experience declaratively, matching the per-platform UI selection. The value is authoritative on every batch apply and reconciles the cross-platform selection table.
• Added support for pre-install query, post-install script, and uninstall script on script-only packages (.sh and .ps1) via the UI, REST API, and GitOps.
• Added an error on the Windows enrollment status page (ESP) when setup experience software fails to install during automatic enrollment (Autopilot and other OOBE flows) and "Cancel setup if software fails" is turned off.
• Added "🛟 Support" as a new default self-service software category.
• Added support for $FLEET_VAR_HOST_* variables in Android configuration profiles.
• Added support for $FLEET_VAR_HOST_* variables in Android managed app configuration.
• Android certificate templates and managed app configurations are now automatically resent when IdP variable values change.
• Added support for defining the default fleet BYO Apple devices enroll into.
• Added a Google Workspace integration that maps identity provider (IdP) users to hosts, populating IdP host vitals directly from your Google Workspace directory.
• Added an activity feed entry when a user runs a custom Apple or Windows MDM command, visible in both the global activity feed and the host's activity feed.
• Added an activity when editing the managed local account setting using the update fleet endpoint or GitOps.
• Enabled tracking of mobile devices for the "hosts online" chart, and added default filtering to that chart that excludes mobile platforms.
• Added tooltips on the Settings > Users and My account pages to show assigned fleets and roles when a user has multiple.

Security Engineers

• Started collecting non-critical CVEs, filtering them out of charts by default.
• Added the ability to filter vulnerable software by severity (CVSS score) and known exploit status on the Fleet Desktop My device > Software tab (Fleet Premium). The corresponding min_cvss_score, max_cvss_score, and exploit query parameters were added to the GET /device/{token}/software API endpoint.
• Added more filtering options for the Vulnerability Exposure chart.
• Added ability to set default Vulnerability Exposure chart filters via GitOps.
• Improved certificate renewal validation in the host identity SCEP service.
• Added support for all IdP variables and host platform in certificate template subject names and SANs.
• Improved input validation for conditional access SCEP enrollment.
• Validated that a custom SCEP proxy certificate authority challenge contains only printable characters, so Windows certificate enrollment no longer fails with "The string contains a non-printable character" (for example, when the challenge contains an underscore). Existing challenges are only re-validated when changed.
• Restricted authorization for team membership management operations.
• Made authorization more robust when creating labels from manual hosts.
• Improved fleet scope validation for software title lookups.
• Restricted authorization for conditional access Okta IdP asset endpoints so that observer and observer+ roles can no longer read them.
• Improved session handling during password reset flows.
• Cleared the SSO authentication cookie after successful authentication for fully-managed Android enrollment.
• Added private network IP blocking to Fleet's HTTP client. Loopback and cloud metadata addresses (127.0.0.0/8, 169.254.0.0/16) are always blocked. RFC 1918 and other private ranges are blocked by default; use --allow_private_network_integrations to allow them for environments with on-prem integrations (e.g. EJBCA, Jira, SCEP servers on private networks).
• Added the s3.carves_cleanup_disabled server setting to skip S3 file carve reconciliation for deployments that rely solely on the bucket's lifecycle policy to remove carve objects.
• Added the s3.carves_cleanup_max_per_run and s3.carves_cleanup_concurrency server settings to tune how many carves the S3 cleanup reconciles per run and how many concurrent S3 requests it makes.
• Updated the SigNoz OTEL dashboards under tools/signoz/ to template and filter on the deployment.environment resource attribute, with the environment variable defaulting to default, so multiple Fleet environments reporting to the same SigNoz backend can be scoped per environment.

Bug fixes and improvements

• Updated Go to 1.26.5.
• Updated checkbox labels in the Fleet UI to use positive language, making it clearer what each setting enables rather than what it disables.
• Improved Windows MDM configuration profile performance. Changes to Windows profiles now reach hosts more quickly. Large changes that affect many hosts at once, such as adding or removing profiles across a team or transferring many hosts between teams, now finish faster and put significantly less load on Fleet's database, keeping the server responsive at scale.
• Improved validation on batch script executions.
• Updated golang.org/x/image to v0.42.0 to resolve CVE-2026-33813 (WebP decoder denial of service on 32-bit platforms).
• Redesigned in-app success and error notifications as toasts. Error notifications now persist until dismissed and can be expanded to show the server's raw response.
• Added configurable batch size FLEET_MDM_ANDROID_BATCH_SIZE (default: 1000 hosts) for Android MDM operations to prevent overwhelming the Google Android Management API.
• Added batching and staggered scheduling for Android software installation jobs to spread AMAPI load across multiple worker ticks.
• Improved the error message shown when saving a custom variable without the required server private key configured.
• Improved software tooltips on the host details page to display the human-friendly software name and correct action labels for scripts.
• Improved orbit check-in performance by deriving the Fleet MDM connection state from existing host MDM data instead of running a separate 3-table JOIN query on every check-in for every host.
• Improved fleetctl to detect when SSO is enabled on the Fleet server and display a helpful message directing users to authenticate using an API token instead of email and password.
• Refactored makeAndroidAppAvailable to use staggered job queuing instead of sleeping between batches inside a single worker job.
• Updated the checkerboard graph to make it clearer which square represents the current time and which squares are in the future.
• Windows configuration profiles are now queued immediately when a host enrolls in Windows MDM, instead of waiting for the next profile reconciliation cron pass.
• Improved query validation logic around policy creation.
• Updated the "installed during setup" tooltip on Controls > Setup experience > Install software to clarify that installation order depends on software name (0-9, then A-Z), and that software without a policy is installed before software with a policy.
• Navigate back to the report details page after saving changes to a report.
• Enabled automatic refreshing of report results when the window is refocused and every 5 seconds while waiting for results to arrive (skipped when report caching is disabled).
• Reduced database write pressure on the Windows MDM check-in path by gzip-compressing stored device response envelopes.
• Updated the Fleet-maintained apps item count to reflect the total number of apps, counting an app's macOS and Windows versions separately (for example, a search for "Zoom" that returns Zoom and Zoom Rooms on both platforms shows 4 items).
• Moved and updated tooltip from the Vulnerabilities column on the Software > OS page to "Not supported", explaining which platforms support vulnerability detection.
• Improved some GitOps error messages around bootstrap packages, setup assistant and scripts.
• Fixed fleet-scoped context when retrieving a list of users in a fleet.
• Fixed an issue where cleanup of expired file carves stored in S3 could stall on buckets containing a large number of objects, which prevented other scheduled cleanup and aggregation tasks from running.
• Fixed the MDM command details modal showing a generic error, instead of a clear message, for a command sent to a host that was later wiped and re-enrolled.
• Fixed SAML SSO callback URLs (both login and MDM end user authentication) duplicating the subpath when Fleet is deployed under a URL prefix, which broke authentication. The callback URL is now built so the subpath appears exactly once whether or not the server URL was configured with the prefix.
• Fixed the My device > Self-service page briefly showing the "Update" button again on apps that had just finished updating, instead of holding the "Updated" state while the software inventory refreshes.
• Fixed a bug where selecting a policy on the host details or self-service policies page reset the list back to the first page.
• Fixed a 500 error when a host reported a software install result for a deleted software installer. When an installer is deleted, records of its pending installations will be set to canceled instead of completely deleted.
• Fixed Copied! confirmation badges showing the wrong border color and clipping in dark mode.
• Fixed installers, VPP apps, and in-house apps sometimes missing from a host's software details page when more than one install or uninstall was queued for the same item.
• Fixed a server panic when validating a Windows configuration profile that mixes SCEP and non-SCEP <LocURI> elements with a non-SCEP element first. The profile is now rejected with a clear validation error.
• Fixed a bug where selected hosts could not be removed (the "X" did nothing) on the live report target selection screen.
• Fixed a bug where if a script-only package was provided with spaces in the path name in a GitOps run, it would fail validation.
• Fixed the GitOps mode tooltip on disabled settings fields so it points at the field's label instead of the center of the label, input, and help text.
• Fixed the dashboard "Hosts enrolled" chart showing an incorrect platform percentage breakdown.
• Fixed Windows MDM not re-installing fleetd on a wiped or re-imaged device that re-enrolls through Autopilot/Entra (OOBE). The server previously treated stale host orbit info as proof fleetd was present and skipped the install, leaving the device MDM-enrolled but without fleetd and hanging the Enrollment Status Page; it now re-delivers fleetd when the host has not checked in since the current enrollment.
• Fixed "My device" page to sort software by display name instead of installer filename when a custom display name is set.
• Fixed a bug where running many concurrent live queries that each target a small number of hosts could overload Redis and slow down host check-ins.
• Fixed browser Back button being trapped on the script batch progress and details pages.
• Fixed a bug where all MDM commands in the command list were incorrectly displayed as "custom MDM command". Only commands run via the custom MDM command API now display this label.
• Fixed fleet-mcp run_live_query returning a 403 error for users with the observer+ role. Multi-host live queries now run as an ad-hoc live query campaign (raw SQL, streamed over the results websocket) instead of creating a temporary saved query, so they require only the live-query permission that observer+ already has.
• Fixed GitOps volume_purchasing_program failing when using All fleets for the fleets field.
• Fixed Fleet-maintained apps that share a macOS bundle identifier (for example Firefox and Firefox ESR) so that adding one no longer renames its software title to the other, and no longer shows the other as already added.
• Fixed a generic error in the software install activity modal when using Fleet Free to show a Fleet Premium message instead.
• Fixed an unclear error message that happened when running fleetctl generate-gitops with an existing patch policy for an installer that no longer references a Fleet-maintained app because it was deleted from the catalog.
• Fixed the configuration profiles batch endpoint timing out when removing many Windows profiles from a team with a large number of hosts. Deleting Windows profiles (including clearing a team's profiles via GitOps, deleting individual profiles, and deleting a team) now returns quickly and the profiles are removed from hosts in the background by Fleet, the same way profile changes are already delivered.
• Fixed the policy and report details pages briefly showing the previously-viewed policy/report's content when navigating between them.
• Fixed horizontal scrollbar showing up when there is nothing to scroll in report and policy results tables.
• Fixed an issue where Windows and Linux hosts that had already enrolled were prompted for end user authentication (an SSO browser tab) when fleetd re-enrolled after a service restart. Re-enrollment of an already-enrolled host no longer requires end user authentication; only genuinely new devices are prompted.
• Fixed a bug where adding a script-only package via path in GitOps made fleetctl generate-gitops produce an invalid file.
• Fixed an issue where Missing hosts filter and dashboard card incorrectly reported iOS, iPadOS, and Android hosts.
• Fixed password reset, user invite, MFA login, change-email confirmation, and SMTP test emails to no longer duplicate the URL prefix in their links when Fleet is deployed under a subpath.
• Fixed software title details pages timing out for installers, VPP apps, and in-house apps with a large backlog of pending host activities.
• Fixed macOS configuration profiles getting stuck in "Verifying" when a host reported a profile install date in a 12-hour time format.
• Fixed the Fleet-maintained apps list being cut off so that apps near the end of the alphabet were unreachable. The list is now paginated (100 apps per page), and the platform and "Hide added apps" filters are applied across the full library instead of only the loaded apps.
• Fixed GitOps relative path lookup for controls.setup_experience.(apple_setup_assistant, macos_script, software.package_path) in unassigned.yml, and org_logo_paths under org_settings.
• Fixed a bug where a script executed in a scheduled batch would still execute on hosts that had been transferred to a different fleet between the time the batch was scheduled and the time it later executed
• Fixed a bug where the MDM command results endpoint might not return hostnames for all returned hosts
• Fixed the activity feed showing a focus outline when an activity was clicked. The outline now appears only when tabbing to an activity with the keyboard, matching the focus behavior used elsewhere in the UI.
• Fixed the agent settings YAML editor (global and fleet-level) hiding command_line_flags behind a comment when set to {} or null. Those values now render as-is, since they have special semantics (they clear all local osquery flags on hosts).
• Fixed "Select all matching hosts" to display the actual total host count instead of "50+" in both the hosts table header and the delete hosts modal.
• Fixed an issue where the macOS "Update new hosts to latest" OS update setting could stay enabled in GitOps after minimum_version and deadline were cleared; when update_new_hosts isn't explicitly set, it now defaults to enabled only while a minimum version and deadline are configured.
• Fixed an issue where more than 8 entries for OS versions would not be paginated.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.57.0
2. fleet-desktop-v1.57.0 (included with Orbit)
3. osquery-5.23.1 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.5.0

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

d715f4992d2769d7ab52647913598d454a7421d1db9f00ec4a1d1df453ca1723  fleet_v4.89.0_linux.tar.gz
e77bee9862c630620ec17ace9cb4b0a206464c3dbe8e5e87098a0af5e850eea7  fleetctl_v4.89.0_linux_amd64.tar.gz
a742a0dcc7d9d4b9018efc762ec296b0549c8b27ac973d46878fb41bb2c863d0  fleetctl_v4.89.0_linux_amd64.zip
ed576fc4a644d31c1ea2ae439b43b7b91b1231d514d43235a85fd415bae7a266  fleetctl_v4.89.0_linux_arm64.tar.gz
4bed2143c01a7ee0c77f71ba949a241d4d9d63555cdde5e0b8dcc03d566f5a7b  fleetctl_v4.89.0_linux_arm64.zip
acad49ecf66fbfe660951052011e902f4e5188fc069950f1c6405e794f1303e0  fleetctl_v4.89.0_macos.tar.gz
c413a5d40b6f2183cc4791b14ed3e8fc7afc8223714c24b2788ab78edb6e4c67  fleetctl_v4.89.0_macos.zip
c7485e2a5f50483482353461036f429048b6395b2b8e1e0dab44a451a5471a69  fleetctl_v4.89.0_windows_amd64.tar.gz
1a8d686eae85afc63fe2c2323ccf6790b05b9e8f0d4bad3dfd3d340f19b65962  fleetctl_v4.89.0_windows_amd64.zip
1a905eeaa14f3c9aa9799024b3870b5736691c4995076558da2fa6bccff5a996  fleetctl_v4.89.0_windows_arm64.tar.gz
0943d521c18861abd37d6afe3c528074bcf86a89934e0c33ab14f5e5adb706d8  fleetctl_v4.89.0_windows_arm64.zip

Bug fixes

• Fixed an issue where a configuration profile could be enqueued multiple times for a single host.
• Fixed recovery lock password being enforced on personally-owned (BYOD) macOS hosts, where it would always fail because personal enrollments have device lock rights stripped. These hosts are now skipped.
• Fixed a bug where a user's BYOD selection was not persisted through IdP authentication
• Fixed a bug where installing App Store (VPP) or in-house apps on an iOS/iPadOS host enrolled with the manual (profile-driven) BYOD enrollment profile failed while trying to look up a VPP user. These device-channel hosts now install apps to the device, the same as company-owned manual enrollment; user-scoped licensing is reserved for Account-Driven User Enrollment.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

1adc9236a16edfdbaa321b3abcbea8fd93354bf348aa1984f1dbf41929f837be  fleet_v4.88.1_linux.tar.gz
c0e6db9c7559487036572a292c8a4acb586fa041524d4e59d76730b4932a7375  fleetctl_v4.88.1_linux_amd64.tar.gz
3396a776f736513f511c7e8486838c0a4d6548d42329b66967d5abe33d8d1616  fleetctl_v4.88.1_linux_amd64.zip
6587d56fa84b8b93a25bc26551c86170de61a3ff00f7ad2745b841522fb9cff9  fleetctl_v4.88.1_linux_arm64.tar.gz
b79a62d090d562fd223b6674a9393f7276b5735fbae38ea5438927ba7a21554e  fleetctl_v4.88.1_linux_arm64.zip
c308cce437f2cca7b24e27aa3501f8da5b072192f31ab68bd763dd33de7facad  fleetctl_v4.88.1_macos.tar.gz
18256e18353febc7205cdaf5512ea820af282c0993ab8908704ee7a958814887  fleetctl_v4.88.1_macos.zip
b6028f87ca1c9f0302f0c8fa496de8f36afb06aab5838131befede5b20d95e93  fleetctl_v4.88.1_windows_amd64.tar.gz
6d67da0f5a97310abfd5772876d6baabe110bc8219e49e08cbea674f8086e60c  fleetctl_v4.88.1_windows_amd64.zip
ff8334a6c8527a7d9ae069492aecf67403197ef4761e99c5526038adf39cc202  fleetctl_v4.88.1_windows_arm64.tar.gz
04db52fdd300cc55ffa94e84163551c0d8777414652ae995ab56fed778d1d873  fleetctl_v4.88.1_windows_arm64.zip

Bug fixes

• Added support for personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions so that personal devices cannot be remotely wiped or locked, and preserving those permissions across SCEP/ACME certificate renewal.
• Fixed an issue where fleetd could intermittently fail to install during Windows MDM enrollment, which could cause the Windows Autopilot Enrollment Status Page to hang.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85280edd8db7ad2212ba5456997cfacdfeeabaf5b6124732f6fb95df45324163  fleet_v4.88.0_linux.tar.gz
847f9bfee46cd8a2f637975efbb4e8b5b2a5ed290af3759361721a4623338631  fleetctl_v4.88.0_linux_amd64.tar.gz
8698436ad196fb0542705d9a1872f7f45a3804e40d87d5e66d889e5def928d73  fleetctl_v4.88.0_linux_amd64.zip
80d52c9b38960a6ddbaf9e6b1545f2aba24210e5c9274efe716eaf7ec33183a5  fleetctl_v4.88.0_linux_arm64.tar.gz
e2be3aa46de32dbde7e998ebf4ccf807021dec2468242f22f1efdd77e1f2014a  fleetctl_v4.88.0_linux_arm64.zip
e6cd3e2e28c955a9f64c8f12c50e1e78935b7a30dac0f9253726725633f19b5d  fleetctl_v4.88.0_macos.tar.gz
f192245fde09f6f9a2a14c34d443114104f55ec93841ec330d6149845b9a8794  fleetctl_v4.88.0_macos.zip
3a113fdf800011ce006a1c68c00f039eaab5d3546c64d21b4bb02209391f55ff  fleetctl_v4.88.0_windows_amd64.tar.gz
109eda99ba889f9aa2d3e676748158cdacfa759125f8484817035beeae42a950  fleetctl_v4.88.0_windows_amd64.zip
5b370cc2d208ce752b073fc11e24f77ad02294881b8ad01fc7ac6f4bc9518860  fleetctl_v4.88.0_windows_arm64.tar.gz
4d029140b782793f5051068129410decfb19d819fb41f83880dccc2ee8304596  fleetctl_v4.88.0_windows_arm64.zip

Bug fixes

• Fixed a bug where an Apple SCEP certificate profile backed by NDES could be marked "failed" and consume one of the host's limited profile retry attempts when its challenge password expired, instead of being automatically resent with a fresh challenge.
• Fixed GitOps runs failing with a software_categories duplicate-entry error when a software category's name differed only by characters MySQL's collation treats as equal (such as the Unicode variation selector in default categories like "🖥️ Productivity").
• Fixed the My device > Software tab appending a macos_applications query parameter to the URL when paginating, even though that page has no /Applications filter.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f2d4e41a21bb117adf090a5803866214ce976880fab0343252b8396d722c8447  fleet_v4.87.1_linux.tar.gz
36adc7723f4b03eea01b287f1235010d036d7aa724dc6b1549150c43ce53c04d  fleetctl_v4.87.1_linux_amd64.tar.gz
c16fc64a4d82176d1f81eb3031024669a2c94f12a49eb2de081b9ca79986e399  fleetctl_v4.87.1_linux_amd64.zip
634d314705e9f081a4a35c2eed0b689234b5883a18c88f2ca6129a251e685d43  fleetctl_v4.87.1_linux_arm64.tar.gz
14bdf0e98f40e2620055cbf35dc7d2d2e51335a215a56290b74d1f4a5f162e25  fleetctl_v4.87.1_linux_arm64.zip
a050f589a44152138527e42d0f2727f2f193eff3c9888f21805e6591b66ba14c  fleetctl_v4.87.1_macos.tar.gz
1901517bb3b62293c1666289795bd04438d43d0817a770a8e2655714c1300dc1  fleetctl_v4.87.1_macos.zip
f1b86d55d567e56168b5760231aec16d1a7f3b6481bd077bdf96044e286958f5  fleetctl_v4.87.1_windows_amd64.tar.gz
8bd5baa2ef829926b6539e935bdd34562018c640a28e53bdb14fcbf591b11db5  fleetctl_v4.87.1_windows_amd64.zip
3fdccd663a6facd8b6dcd79d43c576b108090e7dcab9d00b8b3ffcd465781384  fleetctl_v4.87.1_windows_arm64.tar.gz
08df1022f8fbd6b58995729697c6d520d7bda89253898f28ce405fcf169b4994  fleetctl_v4.87.1_windows_arm64.zip

Fleet 4.87.0 (Jun 19, 2026)

IT Admins

• Added 236 new Fleet-maintained apps for Windows, including Microsoft Office, PowerShell, PowerToys, Power BI, Power Automate, SQL Server Management Studio, Microsoft .NET Runtime 8 and 10, Git, Node.js, Python 3.13 and 3.14, PostgreSQL 15–18, Windsurf, Kiro, Dell Command Update, Lenovo Dock Manager, Nessus Agent, Bitwarden, Canva, Miro, Snagit, Tableau Desktop, VirtualBox, TortoiseGit, GitHub Desktop, and more.
• Added 727 new Fleet-maintained apps for macOS, including Kiro, Codex, OpenCode, Claude DevTools, Granola, Logitune, and hundreds more tools across development, security, productivity, and design.
• Added the ability to deploy custom OS update configuration profiles for Apple and Windows.
• Added support for issuing Lock, Wipe, and Clear passcode commands to Android hosts. Lock and Clear passcode work for both BYO (personal) and COBO (company-owned) Android hosts; Wipe is COBO-only. For BYO hosts, Unenroll now issues an AMAPI WIPE under the hood, which removes only the work profile and leaves personal data intact. All Android commands are issued with duration=315360000s (10 years), matching the pending-forever queue semantics Fleet uses for Apple and Windows MDM.
• Made the Wipe command available to Fleet Free users for Android (company-owned) hosts, in both the UI and the API. Wipe for macOS, iOS, iPadOS, Linux, and Windows hosts remains a Fleet Premium feature.
• Android host display name now uses "{IdP first name}'s {hardware model}" when an IdP account is associated.
• Reduced Windows MDM server and database load by relaxing the device management poll schedule from 1 minute to 8 hours for hosts running a version of fleetd that supports on-demand Windows MDM sync (1.57.0 and later). When commands are queued, the server wakes these devices through fleetd to start a management session, so command delivery stays near real-time. Hosts on older fleetd versions keep the previous poll behavior.
• Renamed Apple Business Manager (ABM) terminology to Apple Business (AB) in the API, GitOps YAML, and fleetctl CLI. The new /api/v1/fleet/ab_tokens and /api/v1/fleet/mdm/apple/ab_public_key endpoints, mdm.apple_business YAML key, and fleetctl get mdm-ab/fleetctl generate mdm-ab commands are canonical. The now-deprecated /abm_tokens, /mdm/apple/abm_public_key, apple_business_manager, mdm-apple-bm aliases continue to work for backwards compatibility and log a deprecation warning when used.
• labels_exclude_any can now be combined with labels_include_all or labels_include_any when uploading MDM configuration profiles, allowing hosts to be included by label membership and excluded by another set of labels simultaneously.
• Added support for setting the end user account type to standard for a standard (non-admin) user or none to skip end-user account creation, both requiring a local admin account.
• Added a "Continuous" option to policy automations that re-runs script and software automations on every subsequent policy failure, with editable automations now available directly on the policy create, edit, and details pages.
• Added the ability for users with the Technician role to transfer hosts between fleets (Fleet Premium only). Global technicians can transfer hosts via the Fleet UI (manage hosts and host details pages) and the REST API. Fleet-scoped technicians can transfer hosts between fleets they manage via the REST API.
• Added Self-service categories page (Premium) under Software > Library for managing custom categories per fleet, including add, edit, and delete flows.
• Added Categories button to the Software > Library page that navigates to the new categories page.
• Replaced the static category sidebar on the My device > Self-service page with a custom-category dropdown driven by the org's self-service categories, and added an "Install all (n)" button per category (with a confirmation modal) that posts to /device/{token}/software/install_all?category_id=:id.
• Added macos_applications filter for host software list.
• Added Fleet "Spotlight" - A command palette that opens when pressing Command + K or Control + K.
• Added a "My device" button on the host details User card so global admins can open the host's end-user My device page in a new tab; Fleet refreshes or generates the device auth token as needed so the link is always valid.
• Showed the end user's IdP full name (e.g. "Jane Doe's device") on the My device page header and browser tab when available; falls back to "My device" otherwise.
• Added support for configuring an optional SES sender domain.

Security Engineers

• Added support for validating Microsoft Entra v2 access tokens during Windows MDM enrollment. Effective July 1, 2026, new on-premises MDM applications created via the Entra portal flow issue v2 access tokens whose audience (aud) is the application's client ID; adding the client ID lets these applications enroll Windows hosts. Existing v1 tokens (audience = Fleet server URL) continue to work unchanged.
• Hardened in-house iOS app distribution by requiring a per-install token in the manifest and package download URLs. The token is minted when an install is enqueued, bound to the target host, and expires after 6 hours, aligning the in-house download flow with the URL-token authentication already used by Fleet's MDM installer and software installer download endpoints.
• Added GCS IAM authentication support for software installers S3 storage using Google Application Default Credentials (ADC) bearer tokens instead of S3 HMAC keys. Configurable via s3_software_installers_gcs_iam_auth.
• Added GCS IAM authentication support for file carving S3 storage. Configurable via s3_carves_gcs_iam_auth.
• Added route-aware head sampling for OpenTelemetry trace export. When tracing_enabled is on, agent firehose endpoints (osquery distributed read/write, orbit ping/config, device desktop/ping) are sampled at 0.1% by default, admin reads at 2%, and everything else (enroll, SCEP, MDM checkin, cron jobs, GitOps batch) at 100%. Liveness probes (/healthz, /version, /metrics) are dropped unconditionally.
• Added GET/PATCH /debug/trace_sampler (admin only, behind the existing /debug auth) for adjusting ratios or flipping a 100% force_full debug window at runtime. Each Fleet replica polls the new trace_sampler_settings row every 60 seconds and applies changes without a restart.
• Updated the vulnerability processing guide to clarify Linux vulnerability scanning coverage, including a per-distribution table covering OS/kernel, system packages, and cross-platform packages and which scanner is used for each.

Bug fixes and improvements

• Updated Go to 1.26.4.
• Significantly improved performance of the Apple profile and DDM reconciler.
• Improved the performance of listing labels with host counts by aggregating membership counts in a single pass instead of a per-label subquery, and skipping the unnecessary join to the hosts table when the requesting user can see all hosts.
• Android profiles now use content checksums to determine when to re-sync, avoiding unnecessary re-delivery on unrelated policy changes.
• Long policy resolution text now wraps on the policy details page instead of being truncated.
• Updated initialization semantics around api_endpoints. The catalog is now loaded from the embedded YAML once at package initialization time.
• Added Python 3.14 and Python 3.13 as Windows Fleet-maintained apps.
• Normalized Python's reported version on Windows (e.g. 3.14.5150.0 -> 3.14.5) so software inventory and vulnerability matching use the real version.
• Replaced the "Osquery" column with a richer "Agent" column on the Hosts page that shows Orbit version with a tooltip displaying osquery, Orbit, and Fleet Desktop versions.
• Hid "Issues" and "Private IP address" columns by default for new Fleet instances.
• Added hosts page tooltip to MDM status on hover.
• Added certificate rollover process to MDM assets tool.
• Added a migration cleanup tool for recovering failed starts after renumbered migrations.
• Added each platform's percentage of total enrolled hosts to the "Hosts enrolled" card tooltip on the dashboard.
• Updated conditional access policy query to use parameter binding for platform filter.
• Rejected Windows MDM configuration profiles that don't contain at least one supported SyncML top-level element (<Replace>, <Add>, <Exec>, or <Atomic>), so non-XML or empty payloads are caught at upload instead of failing on devices.
• Updated to now prevent deleting a label that is in use by an MDM configuration profile or declaration, returning an error instead of silently breaking the profile's label targeting.
• Raised the default FLEET_REDIS_HOST_CACHE_TTL from 60s to 180s and removed the reverse-index GETs that the host-update invalidation path performed. Together these reduce DB reader load and lower Redis CPU usage.
• Surfaced continuous_automations_enabled in GitOps YAML (read and generated by fleetctl generate-gitops).
• Stopped the 1Password autofill icon from appearing on Fleet UI inputs that are not credential fields.
• Hid the "Rotate password" button in the Recovery Lock password modal for users with the Observer role, instead of showing it as disabled.
• Updated Android Enterprise connect to surface real error messages to the user.
• Updated self-service activity copy to passive voice without an "end user" actor (e.g. "GitHub Desktop was installed on this host (self-service).") on both the host activity feed and the dashboard global activity feed.
• Updated GitOps error message about exceptions to include the URL to visit to disable exceptions.
• Updated the error displayed when GitOps encounters an unknown env var to account for cases where the string is a literal that needs escaping.
• Removed orphaned duplicate SCEP certificates from the per-user keychain automatically after an Okta conditional access profile is reinstalled or renewed on macOS hosts.
• Reduced the Apple MDM lock state cleanup timeout from 5 minutes to 1 minute, decreasing the time a recently unlocked host may still appear as locked in Fleet.
• Rejected Windows MDM configuration profiles whose <LocURI> is empty, starts with /, or contains .. path traversal segments, so invalid OMA-DM URIs are caught at upload instead of failing on devices.
• Refactored ListHostSoftware and ModifyAppConfig into smaller helpers so nilaway can analyze them for nil-pointer dereferences.
• Refactored MDM profile label-targeting logic (include all/any, exclude any) into a shared platform-neutral package so Apple and Windows reconcilers use the same rules.
• Slimmed down the POST /api/v1/fleet/targets response to omit unused fields.
• GitOps now prints a message for each software package it will delete.
• Fixed the Add host modal so its read-only installer command fields can no longer be resized.
• Fixed an issue where the checkerboard would be colored based on relative percentages rather than relative absolute value.
• Fixed a race condition where deleting a policy while a host had an outstanding distributed query for that policy caused a foreign key constraint error during /api/v1/osquery/distributed/write.
• Fixed SCEP PKIOperation handler incorrectly decoding base64 + characters as spaces.
• Fixed software installer edits cancelling pending setup experience installs and causing setup experience to fail if all software is required.
• Fixed a bug where navigating to the Fleet root URL returned a 404 in subpath deployments.
• Fixed bug in apply to prevent setup_experience in software items from being renamed to macos_setup.
• Fixed a bug where the "Add custom variable" modal would clear entered values when switching focus to another browser tab or application window.
• Fixed fleetctl preview disabling dashboard chart data collection (Hosts online, Vulnerability exposure) on startup.
• Fixed a race condition after Windows BYOD MDM enrollment (Settings > Access work or school > Connect) where mdm_windows_enrollments.host_uuid stayed empty for several seconds, causing server-side enrollment lookups to miss. The enrollment is now linked to the Fleet host record at the first management session via OMA-DM DevDetail/SMBIOSSerialNumber instead of waiting for osquery's distributed-read backfill.
• Fixed MDM status column in the host table showing "On (automatic)" instead of "On (company-owned)".
• Fixed logout/login redirects to respect the URL prefix in subpath deployments.
• Fixed the mdm_unenrolled activity not appearing in a host's activity timeline on the host details page.
• Fixed software titles displaying the raw package name instead of the admin-set display name in the policy automations list and edit modal, the patch automation CTA, the hosts software filter pill, and the setup experience software row.
• Fixed an issue where ADE-enrolled macOS hosts didn't report FileVault until restarted.
• Fixed Android profiles temporarily failing when transferred to a team with certificates by ensuring certificates are provisioned before dependent profiles are applied.
• Fixed an issue where the "Get host's OS settings" API endpoint returned an error when only Android MDM was enabled.
• Fixed fleetctl get fleets (and fleetctl get teams) so the software section, including each app's setup_experience value, reflects the real configuration instead of being read from the (potentially stale) team config. Software is now fetched from the software titles and setup experience endpoints, which are the source of truth.
• Fixed an issue where GitOps would fail on the first run after deleting the bootstrap package in the UI.
• Fixed login failing with an "Authentication Required" error when Fleet is served over HTTP, by storing the auth token in a non-secure cookie outside of HTTPS contexts.
• Fixed Android devices losing their team assignment and certificate configuration when the host record is deleted and the device re-enrolls.
• Fixed a bug where host vitals labels (e.g. IdP group/department labels) scoped to a fleet/team never got any hosts. The membership cron only looked at global labels, and team-scoped IdP labels also failed to populate due to an incorrect SQL join.
• Fixed inline error for duplicate certificate name not showing when the conflicting certificate is on a different page.
• Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).
• Fixed Fedora wipe to delete btrfs snapshots (including read-only ones) before wiping the filesystem, preventing snapshots from surviving the wipe.
• Fixed Scripts library action buttons (edit, download, delete) being unreachable via keyboard navigation, and added accessible labels so screen readers can distinguish them.
• Fixed corrupted vulnerabilities download removing existing detections.
• Fixed iOS and iPadOS logos on the OS list in dark theme.
• Fixed a bug where deleting one of multiple duplicate DEP hosts did not resolve the duplicate. Fleet no longer recreates a pending host record when another host with the same serial and platform still exists.
• Fixed an issue where updating the device mapping for a host with no user, or a non-existent IdP user, would not resend config profiles using IdP variables.
• Fixed a bug where the carve cleanup cron job called the MySQL implementation instead of the S3-aware implementation on S3-configured deployments, meaning expired carves were never marked as expired in S3. Also fixed a panic in S3 carve cleanup that occurred when there were no non-expired carves.
• Fixed Android Enterprise page not refreshing after connecting or disconnecting Android MDM, so the Enterprise ID and card state are visible without a manual page reload.
• Fixed List certificate templates API docs: query parameter was incorrectly documented as fleet instead of fleet_id, causing the parameter to be silently ignored and returning no results.
• Fixed a bug where Android device check-ins could silently revert admin team transfers.
• Fixed GET /api/v1/fleet/vulnerabilities returning raw SQL errors when using cursor pagination (after) with order_key set to cve, hosts_count, or cve_published.
• Fixed a bug where patch policies with software install automations used an inactive, older installer and not the latest.
• Fixed "Show example payload" button being incorrectly disabled in GitOps mode on the "Other workflows" and "Calendar events" policy automation modals.
• Fixed stale pending MDM profiles reappearing after globally toggling Apple or Windows MDM off and back on.
• Fixed the live policy page not using the full page width like the live query page does.
• Fixed a bug where in GitOps, if a patch policy was specified with a different FMA slug for the install software automation, it would be used for the query instead of the slug for the patch policy itself.
• Fixed false positive vulnerability CVE-2017-17522 reported for Python (this CVE is disputed and not exploitable).
• Fixed false positive vulnerability CVE-2023-36632 reported for Python (this CVE is disputed; the reported behavior is intentional).
• Fixed false positive vulnerability CVE-2024-3219 reported for Python on macOS and Linux hosts (this CVE only affects Windows).
• Fixed the GET /api/v1/fleet/hosts endpoint so that filtering Android hosts by os_name=Android and os_version=<version> returns the matching hosts. Android hosts now populate the operating_systems table on enrollment and on every status report, and also appear in the GET /api/v1/fleet/os_versions aggregation and OS list in the UI with the Android logo.
• Fixed "User email" in device_mapping being unset in GET /api/v1/fleet/hosts for Windows and Linux hosts enrolling with end-user authentication.
• Fixed GET /api/v1/fleet/software/versions returning HTTP 422 "too many placeholders" when called without a per_page parameter on instances with large software inventories.
• Fixed host software list surfacing stale installer metadata after a Fleet-maintained app was replaced, which caused label scope to be evaluated against the previous installer and disagree with the install endpoint.
• Fixed the "host is offline" banner on the My device page incorrectly appearing during the first few minutes after an enrollment.
• Fixed software title icon not-found errors (and other 4xx errors) being reported as server-side exceptions in OTEL traces, APM, Sentry, and the Redis-backed debug errors endpoint.
• Fixed the host's Software UI showing a date decades in the past (e.g. "over 46 years ago") instead of "Never" for apps reporting a sentinel last_opened_time such as 315532800 (1980-01-01 UTC) that were never opened. Added a migration to clear these sentinel values from previously ingested software.
• Fixed latency issues with /vulnerabilities and filtered /software/versions queries.
• Fixed fleetctl gitops to refuse to apply SSO / EUA config that is missing required fields, if SSO is enabled globally or EUA is enabled on any team.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.56.3
2. fleet-desktop-v1.56.3 (included with Orbit)
3. osquery-5.23.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.5.0

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

84c30873b5c5f19eb106af06b683d1417cfe31e6ea83d20d4accabbbbb0a30c6  fleet_v4.87.0_linux.tar.gz
5e66cac64e638653d10408c0cb29a4347777c20f42918c71c44f401dcd5782c9  fleetctl_v4.87.0_linux_amd64.tar.gz
582ca37fa6f8d346b76accc01ba54c84580b5226b4bcac1b77cf16acc0dca758  fleetctl_v4.87.0_linux_amd64.zip
abfe74b1205db855d84089293e83f0da6879e9189b10d00e4b955103fabdb4ca  fleetctl_v4.87.0_linux_arm64.tar.gz
30dfe07dc79fa29f6041453f679eb0cf447a8ed9ead60ce2b8d3a78320654397  fleetctl_v4.87.0_linux_arm64.zip
e120376970999454621c8681dd93e5550a8abc215cdaf0fc829e4fdf6920c721  fleetctl_v4.87.0_macos.tar.gz
3bfa0dab428a5f16d663f01f04ad5a1470c6a717dc6d7c5ee8635f7fa6e27123  fleetctl_v4.87.0_macos.zip
b90daa7e89a5650bc53ab44278da28a2a73caafcb9d33bce6d5eb9061aaa2c08  fleetctl_v4.87.0_windows_amd64.tar.gz
0c5b67741f2b656e6ce3d25c363add56edf22b40c772a197a5c632d26da99752  fleetctl_v4.87.0_windows_amd64.zip
149097c840c4561d9108689db2ac7c492cf52a57ff50b228148af4054fa2823f  fleetctl_v4.87.0_windows_arm64.tar.gz
df24bc4512030f99f58da991fc2f3712a82624ac3bb0b690d21966f4f4924f21  fleetctl_v4.87.0_windows_arm64.zip

Bug fixes

• Fixed Fleet failing to start on a read-only root filesystem by storing custom org logos in the database when no S3 software installers bucket is configured, instead of writing to local disk.
• Fixed a bug where host vitals labels (e.g. IdP group/department labels) scoped to a fleet/team never got any hosts. The membership cron only looked at global labels, and team-scoped IdP labels also failed to populate due to an incorrect SQL join.
• Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85d05a46359c6cedfc876ea6646e86c46530a5e0253a4144310dc2f8f9b64055  fleet_v4.86.2_linux.tar.gz
f523b48ac462afbefec073a1f04f622bbc0b2b6263377be85d64b8feb5cc219b  fleetctl_v4.86.2_linux_amd64.tar.gz
e55e5d95c8c20b9be7e1b3d30bea077a37b1530440309ff068e9a13812d6e6be  fleetctl_v4.86.2_linux_amd64.zip
0c921a88d30de3679e903cacd8256d1905f0013438827f7569e7bf8cb301284b  fleetctl_v4.86.2_linux_arm64.tar.gz
406910bcc05ec7b6e4629717d5c990295388677ba2b432cb1d05d8cdd591d7ba  fleetctl_v4.86.2_linux_arm64.zip
d8ccd61b5765c8b4052c09c2b5ac832479bf296f77e8f2789cd6397c21d4375d  fleetctl_v4.86.2_macos.tar.gz
c97d41a5defcdebbc049fae4ddfa1b4167e6f39eb5eb5a45c29d39517c9c1187  fleetctl_v4.86.2_macos.zip
978ce2ef670afe9ed539426eb635331ca358f83ebebd3823225c530704b9302b  fleetctl_v4.86.2_windows_amd64.tar.gz
8c310d15fdc7264804b6d22a013fbe0bb09804799234668490840b00258f1004  fleetctl_v4.86.2_windows_amd64.zip
be8bab06e4ff592d7cd3a177ec2cb3487b4f0bf1da1d0afd4f49d7a9299b163e  fleetctl_v4.86.2_windows_arm64.tar.gz
b72948b6f18cf5a01ab5d95702b1d501350a60f9f8fe841a5b07cf9233dea278  fleetctl_v4.86.2_windows_arm64.zip

Bug fixes

• Updated conditional access policy query to use parameter binding for platform filter.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

995b74191f79783defd244c5538f93b9ae0da7a2bf99f7668775088cd8f7a735  fleet_v4.86.1_linux.tar.gz
0c5b031e5e973e3f8f96307cfdaa55a33a0ab4e7859eee52150bda51572c7349  fleetctl_v4.86.1_linux_amd64.tar.gz
2883b8166c8b09a584de75708558c926b74df4eab48229972b098d40570952d0  fleetctl_v4.86.1_linux_amd64.zip
eab4e7814d6bd76ec07b662833a0289ecade4b9226efb24b8727459bfc3f3fcc  fleetctl_v4.86.1_linux_arm64.tar.gz
92ceee1089c4be0d74afc5289f6e3faa165efb38d4a1a9059fe06c13794cfbbd  fleetctl_v4.86.1_linux_arm64.zip
d4f7db86dcb60dc241177505819c20619401dbbbd6003c0091a2888e1d921d36  fleetctl_v4.86.1_macos.tar.gz
ab6510afc7686f5416596da16476b5a996dfa86d5b7dded6d77f85ff228f96a0  fleetctl_v4.86.1_macos.zip
faaa144f2c26ca72cefc398fe126ab04808bee859860f0ad913c6571e6594036  fleetctl_v4.86.1_windows_amd64.tar.gz
de073acde2f4ced32dff7a20250058085134d0a220714208aee51ecde345b665  fleetctl_v4.86.1_windows_amd64.zip
d2b2473f6d6e11c6dfb511b6f44d22c2d4f69b4d8c4065129e334d13734ec6a7  fleetctl_v4.86.1_windows_arm64.tar.gz
70ddf117dbd1b86a6eeb2a2cec97fe89611e621040c4e33092c1ce1d247c7d3e  fleetctl_v4.86.1_windows_arm64.zip

Bug fixes

• Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

78ebca78943efcd4e86a0096ab60520014261e2081446e9ef6452c50430d4eea  fleet_v4.85.2_linux.tar.gz
d86d60c67b45fa02de9408a5a8d8ed9770c95ceeb9e0709be17aa65ce9d06b0d  fleetctl_v4.85.2_linux_amd64.tar.gz
ba300343e351f9fe514b46147115836ecb61eaf479ef28e2918eb5d55dec8641  fleetctl_v4.85.2_linux_amd64.zip
8611adc78afb8556b14e745616355a870e85ea6d32e9d11e2e0ae9724841c689  fleetctl_v4.85.2_linux_arm64.tar.gz
642cd1a47ed8e13214785d0fc0c8892d8690adbca062ea3a7bab715983e7a20d  fleetctl_v4.85.2_linux_arm64.zip
2f84e5fe342117b7f1eb4a4349eeaf8a1b6ceaf7b5454230a9cc751c9c1c95bb  fleetctl_v4.85.2_macos.tar.gz
26b95926eb50904b5302f83c0a47760f486c08b1e8c9fb3703ba9a331fe9cd70  fleetctl_v4.85.2_macos.zip
a85f85b022c850a70372e7c1707f76c8f87f187758c5289ed570e26065c430b8  fleetctl_v4.85.2_windows_amd64.tar.gz
8473a426386690468bf4a689027eab588fdaeb73cb4b701fd4e5eb50a5e44a2e  fleetctl_v4.85.2_windows_amd64.zip
c155bb3393354c33da9c8b67ff5974fff690a11af1857d3d5e44008fd47df148  fleetctl_v4.85.2_windows_arm64.tar.gz
4b38085f4df9574f27a1a36f73a2d192f3faeee973face0c357c4b4dc94b7b2d  fleetctl_v4.85.2_windows_arm64.zip

Fleet 4.86.0 (May 29, 2026)

IT Admins

• Added automatic rotation of managed local admin account passwords after they have been viewed.
• Added a require_all_software_windows setting to cancel the Windows setup experience if any software install fails during Autopilot enrollment, matching the existing macOS behavior.
• Added GitOps support for uploading custom org logos. fleetctl gitops accepts org_logo_path_dark_mode and org_logo_path_light_mode keys to upload local files, and fleetctl generate-gitops exports Fleet-hosted logos as local files alongside path keys while keeping external URLs as org_logo_url_*_mode keys.
• Added support for installing VPP and in-house (.ipa) apps on iOS and iPadOS hosts enrolled via Account-Driven User Enrollment with a Managed Apple Account.
• Enabled self-service software installs from the My device page for user-enrolled iOS and iPadOS hosts.
• Enabled setup experience software in Controls > Setup experience to install automatically on user-enrolled iOS and iPadOS hosts at enrollment.
• Provisioned a VPP client user per Managed Apple Account on first install, and associated VPP licenses to the user rather than the device, supporting Apple's up-to-5-devices-per-user licensing semantics.
• Added managed app configuration for iOS and iPadOS apps (VPP and in-house), configurable via UI, REST API, and GitOps, with $FLEET_VAR_* substitution.
• Added support for VPP apps purchased from non-US-based Apple Business accounts.
• Added the ability to upload a custom organization logo for light and dark modes, hosted by Fleet, replacing the previous URL-only flow on the setup screen and organization settings page.
• Added include_all label scope to policies, and include_all and include_any label scopes to reports, including support via GitOps and fleetctl.
• Added a "Custom" target dropdown when creating or updating reports under the premium tier.
• Added an "Include all" option to the "Custom" target dropdown on Policies for premium users only.
• Added permissions for the GitOps user to list software titles.
• Added support for setting gitops_mode_enabled and repository_url via GitOps.
• Added output to GitOps for scripts, indicating how many scripts would be applied (dry run) or were applied.
• Added activity entries for retried software installs and script runs from policy automations.
• Added an activity when hosts fail enrollment profile renewal.
• Added activities when users create, edit, or delete labels (created_label, edited_label, and deleted_label).
• Added "Hosts online", "Hosts enrolled", and "Vulnerability exposure" charts to the dashboard.
• Added an option to convert and return a PEM-encoded X.509 certificate instead of a PEM-encoded PKCS7 envelope from the Request a Certificate endpoint.
• Added a deprecation warning when using setup_experience.software or macos_setup.software keys in config.
• Released fleetctl as a pkg for macOS.
• Released fleetctl as an msi for Windows.
• Enabled wiping a host to cancel all of its upcoming activities.
• Updated the default automatic enrollment profile, and added the ability to download and view the applied default profile.
• Updated OS version reporting for iOS and iPadOS to include the Rapid Security Response suffix (e.g. (a)) when the device reports a SupplementalOSVersionExtra field via MDM.
• Updated fleetd and MDM enroll activities to display the serial number and preserve the osquery-provided display name.
• Required the --host flag for fleetctl get mdm-commands, and deprecated GET /api/v1/fleet/commands without a host_identifier.
• Cleared host vitals on ABM host re-enrollment, with a config option to preserve past host activities.

Security Engineers

• Added macOS 26 CIS Benchmark v1.0.0.
• Updated CIS Windows 11 Enterprise benchmark policies from v4.0.0 to v5.0.1, adding 17 new L1 policies and updating 42 existing policy titles.
• Surfaced hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.
• Added SVG support for custom organization logos, with strict server-side sanitization to reject scripts and other unsafe SVG content.
• Added support for the subject_alternative_name field on Android certificate templates.
• Optimized OSV vulnerability scanning to query distinct software per OS version rather than per host, reducing redundant database queries for many hosts sharing the same packages.
• Improved vulnerability scanning performance by using a per-vendor product cache during CVE matching to optimize translate_cpe_to_cve.

Bug fixes and improvements

• Updated Go to 1.26.3.
• Removed debug symbols from fleet and fleetctl executables to reduce binary size.
• Reduced database load from GET /api/latest/fleet/device/{token}/desktop and other Fleet Desktop endpoints when invalid or expired device auth tokens are presented, by resolving the token to a host ID with a single-table indexed lookup before running the multi-join host-details query.
• Improved Windows MDM performance when transferring large numbers of hosts between teams or applying bulk profile changes. These operations now return quickly and roll out profile updates to Windows hosts in the background, so host check-ins and other MDM activity are no longer slowed down while a large change is in progress.
• Added a Redis-backed cache for host lookups on the osquery and orbit authentication paths. Successful lookups are cached for 60s (±10% jitter) and invalidated on writes that mutate cached host fields. Reduces reader-side DB load at scale without changing the HTTP contract. Requires Redis 6.2 or later.
• Added a missing uninstall option on the host software library even when an installer has no matching software in the host's inventory.
• Improved Windows MDM profile removal performance by scoping the desired-state subquery.
• Improved Windows MDM profile removal performance by skipping redundant database writes for verified-remove ACKs.
• Consolidated non-variable templated Windows MDM profile command inserts from one per-profile to a single bulk insert.
• Added a periodic cron job to clean up the Windows MDM command queue, reducing write pressure during ACK transactions.
• Made host team assignment sticky across orbit and osquery re-enrollments.
• Improved errors returned from the API when running fleetctl commands by dropping path and status code.
• Improved validation of order parameters on list endpoints.
• Added the orbit.debug_logging_on_enroll_duration agent option to enable orbit debug logging for a specified time period after enrollment.
• Improved validation for invalid order_key values in /api/v1/fleet/commands, /api/v1/fleet/mdm/commands, and /api/v1/fleet/mdm/apple/commands endpoints.
• Improved the error message when the name key is omitted from a GitOps YAML file.
• Improved the error message when deleting a label used for targeting a software installation.
• Updated fleetctl gitops to warn when labels: is specified in no-team or unassigned files, where it is not supported.
• Updated the expired Fleet Premium license CLI banner to link to https://fleetdm.com/learn-more-about/downgrading instead of a stale FAQ anchor.
• Updated the Edit label page to reference "fleets" instead of "teams" when a label is associated with a fleet.
• Updated the setup experience Users card with a link to PSSO local account documentation.
• Updated empty state copy to be action-oriented. Headers describe the current state ("No hosts", "No policies for this fleet") instead of prompting action. Body text explains what to expect. CTA buttons are explicit ("Add policy", "Schedule a report") and permission-gated.
• Updated empty states on Hosts, Reports, Policies, and Software pages so search bars, filters, and dropdowns remain visible but disabled when empty, avoiding layout shift when the first item is added. Item count remains visible.
• Updated Settings, Fleets, Ticket destinations, Certificates, and Identity provider pages with consistent page descriptions and learn-more links.
• Updated empty state visuals to a fresher, consistent design.
• Updated timestamps with tooltips on the host Vitals component to always use cursor: pointer.
• Updated the version of the checkout action in the fleetctl new template to avoid Node warnings.
• Updated the MSI builder to skip packaging the unusable "dummy" secret value when building fleetd-base.msi for Autopilot installs.
• Scoped install commands for user-enrolled hosts to the host's Managed Apple Account (clientUserIds) instead of serialNumbers, so apps install on the correct user account on the device.
• Surfaced a clear host-level error when license association fails during install (for example, no licenses available or the user has reached the 5-device limit) instead of failing silently.
• Made created_at upper-bound filtering consistent on the list activities API. The endpoint now caps results at now by default whether or not start_created_at is provided, matching the documented behavior of end_created_at.
• Unified access to global and team policies in the UI by using the now-generic GET /api/latest/fleet/policies/:id endpoint.
• Wrapped Get-ItemProperty calls in try/catch blocks during registry enumeration to gracefully handle terminating exceptions (e.g. System.InvalidCastException) from malformed registry entries, logging the offending path instead of aborting.
• Replaced the cryptic "startTLS error: ..." flash with a prescriptive message when saving SMTP settings fails because SSL/TLS is disabled but STARTTLS is still enabled. Added a tooltip on the SSL/TLS checkbox pointing to the STARTTLS toggle in Advanced options.
• Removed a dead SQL condition in hostVPPInstalls that was misleading but harmless. Android VPP apps never produce nano_command_results entries (they use Google's Android Management API, not nanoMDM), so the previous (hvsi.platform != 'android' OR ncr.id IS NULL) guard was a tautology. Replaced with a clarifying comment.
• Fixed filtering on the /api/v1/fleet/labels/:id/hosts endpoint.
• Fixed the usage_statistics cron failing against fleetdm.com when a large number of near-identical network errors accumulated in the error store.
• Fixed fleetctl gitops failing with HTTP 500 on subsequent runs when a custom software icon's bytes were missing or had failed integrity in the icon store. The server now returns a 409 Conflict from the metadata-only icon update path, and the gitops client falls back to a full upload to recover the bytes automatically.
• Fixed SAML JIT provisioning so FLEET_JIT_USER_ROLE_* attributes with empty, whitespace-only, or missing values are treated as null and ignored instead of failing SSO login.
• Fixed an issue where GitOps controls with only certain keys would not be seen as set.
• Fixed recovery lock password not being retrievable for hosts transferred to a team with recovery lock disabled.
• Fixed Fleet's Docker image failing to start in Kubernetes with an unknown userid error, triggered by a fleetctl dependency side effect.
• Fixed a GitOps failure ("converting NULL to uint is unsupported") when moving labels from global to fleet scope, caused by deleted label associations with NULL label_id values in mdm_configuration_profile_labels and mdm_declaration_labels.
• Fixed fleetctl gitops --dry-run intermittently failing with "Resource Not Found" when a team's software config was empty.
• Fixed the MDM SSO callback returning a "missing profile" error for Android enrollment when Apple MDM is not configured.
• Fixed the team PATCH endpoint rejecting mdm.enable_disk_encryption on Fleet deployments where only Windows MDM is configured. Team-level BitLocker enforcement can now be toggled when either Apple MDM or Windows MDM is configured.
• Fixed an issue where the disk encryption table on the Controls > Disk encryption page did not support horizontal scrolling at narrow viewport widths.
• Fixed Linux total disk space being double-counted when a filesystem was bind-mounted at multiple paths (e.g. snap-confine's /tmp/snap.rootfs_*).
• Fixed fleetctl gitops rejecting path: values whose actual filenames contained glob metacharacters even when the file existed at that literal path.
• Fixed GitOps failing when it attempted to create a label and a consumer of that label (e.g. a profile) in the same run.
• Fixed gitops --dry-run to reject label specs with invalid platform values.
• Fixed the SSO invite acceptance flow by resolving the email from the invite token.
• Fixed batch script endpoints to return 404 Not Found instead of 200 when the batch execution ID does not exist: /api/v1/fleet/scripts/batch/:id, /api/v1/fleet/scripts/batch/summary/:id, and /api/v1/fleet/scripts/batch/:id/cancel.
• Fixed a class of silent SCEP managed-certificate renewal failures by recovering host_mdm_managed_certificates rows that previously got stuck after the cert ingest matcher missed linking a renewed certificate.
• Fixed the upcoming activity count on the host details page not updating after installing or uninstalling software.
• Fixed an issue where GitOps incorrectly rejected keys in Google Calendar API key JSON.
• Fixed 500 errors on POST /api/v1/fleet/scim/Users when the matched host was already mapped to a SCIM user. The host now gets reassigned to the newly-created SCIM user.
• Fixed an incorrect CPE match on the "slate" Homebrew program.
• Fixed a bug where applying GitOps to a script-only package by hash_sha256 reference would wipe the install script, causing self-service installs to silently no-op.
• Fixed fleetctl vulnerability-data-stream to also download OSV (Ubuntu and RHEL) artifacts.
• Fixed a missing deleted_policy activity when a patch policy is removed by GitOps as a result of its underlying Fleet-maintained app installer being removed from the YAML.
• Fixed a nil-pointer panic in the Android Enterprise Pub/Sub endpoint that occurred when Google's Android Management API sent a device payload missing hardwareInfo, softwareInfo, or memoryInfo.
• Fixed an issue where, if a custom Apple MDM URL was set, SSO for end user auth would fail.
• Fixed slow load times and timeouts on the list MDM commands API (GET /api/v1/fleet/commands) on Fleet deployments with many Windows hosts. The endpoint now caps per_page at 1,000 (default 10) and page at 100. Requests above either limit return HTTP 400. To traverse beyond 100 pages, use cursor pagination via the after query parameter.
• Fixed GitOps dry-run to correctly detect the conflict when both macos_manual_agent_install and macos_script are configured under setup_experience. Previously, the dry-run would succeed while the actual GitOps run would fail.
• Fixed fleetctl gitops apply not clearing stale broken mdm_configuration_profile_labels rows after a referenced label was deleted, which caused profiles to remain enforced on hosts regardless of updated label targeting.
• Fixed GET /api/v1/fleet/commands returning a SQL error when called with host_identifier and the after cursor parameter, particularly with order_key=command_uuid or order_key=hostname.
• Fixed a UI bug where editing an existing global user to enable two-factor authentication failed with a 422 error.
• Fixed an issue where an old APNs cert would stay in memory until a restart, instead of correctly updating in place.
• Fixed a UI inconsistency with non-center-aligned Fleet premium messages on Fleet Free.
• Fixed a bug where duplicate software installers for Linux could be added.
• Fixed the "Back to host details" button on a report's details page navigating to the reports list instead of the host's details page after creating a report from a host.
• Fixed IdP host vitals (full name, department, groups) not populating on the host details page for macOS devices migrated from another MDM via the Tahoe (macOS 26+) end-user-authentication flow.
• Fixed POST /api/v1/fleet/queries returning HTTP 500 when name or query is JSON null. The endpoint now returns HTTP 400.
• Fixed GET /api/latest/fleet/policies/:id (and alias GET /api/v1/fleet/global/policies/:id) to return and properly populate team policies, and to perform an authorization check on team policies before returning.
• Fixed an issue where GitOps dry-run would not validate Apple config profile payload scope conflicts or the use of unknown Fleet variables in all types of profiles.
• Fixed Android hosts being auto-deleted by host expiry on every cleanup tick after re-enrolling, which previously caused an hourly enroll/delete loop while host expiry was enabled.
• Fixed an issue where replica lag could lead to devices not being assigned a setup experience profile on device sync from DEP.
• Fixed the Location and MDM status vitals on the My device page rendering as clickable links even though they had no associated modal, by rendering them as plain text in read-only contexts.
• Fixed the Export hosts button to always reflect the current sort, search, and filter state instead of potentially using stale values.
• Fixed a false-positive update_conditional_access_bypass activity that was created whenever any app config setting was changed while Okta conditional access was already configured with bypass_disabled: true. Also stopped the related side effect of clearing existing conditional access bypass records on those unrelated saves.
• Fixed UI elements in the script library not respecting GitOps mode when enabled.
• Fixed POST /packs with a JSON null name silently creating a pack with an empty name. The endpoint now returns a 400 Bad Request, matching the behavior for an empty-string name.
• Fixed stale "Selected hosts" on the Edit label page after a previous edit by invalidating the related query caches on success, and when navigating between manual labels by scoping the hosts cache per label and keying the form on the actual host set.
• Fixed subtle text alignment issues in the UI.
• Fixed a file descriptor leak in vulnerability processing where deleted goval_dictionary sqlite files were kept open until Fleet server restart.
• Fixed setup experience remaining stuck for up to 90 minutes after a software installer was edited or deleted while a host was installing it.
• Fixed the Policy details modal not closing when navigating back to the Host details page with the browser's back button.
• Fixed software titles list sorting to use display name instead of installer filename when a custom display name is set.
• Fixed the missing "Conditional access" section header on the Settings > Integrations > Conditional access page on Fleet Free.
• Fixed fleetctl gitops silently accepting labels with invalid parameter combinations (e.g. manual labels with query/criteria/platform).
• Fixed validation that rejected enabling end user authentication on Fleet deployments without Apple MDM configured. End user authentication covers macOS Setup Assistant, Windows MDM, and Linux Orbit enrollment, so the toggle now works on Windows-only and Linux-only fleets as long as the IdP is configured.
• Fixed an issue where the MDM solution name reported for a host could flip between values across osquery ingestions when the MDM server URL contained substrings matching multiple known MDM vendors.
• Fixed a bug where enable_host_users defaulted to false on a fresh Fleet install instead of the documented default true, causing the host details page to show "User collection has been disabled."
• Fixed the IdP "Department" host vital not populating for users whose IdP-to-SCIM mapping included enterprise extension attributes that Fleet does not store.
• Fixed the Actions dropdown in the Run script modal within the Host details page automatically closing after 2-3s.
• Fixed GitOps dry runs failing when a VPP app references a label that was added in the same run.
• Fixed a bug where enrolling an Android device on a Fleet instance with Apple MDM disabled produced a duplicate host record.
• Fixed Fleet-scoped users getting a 403 when viewing past activities on a host that has user-initiated activities (e.g. lock/wipe/run script/install software), and fixed missing permissions on host activity items for fleet-scoped users.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.55.0
2. fleet-desktop-v1.55.0 (included with Orbit)
3. osquery-5.23.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.5.0

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

94eb92a6094879002228cbfbac376dbd9889130d54d4f06463004a143d209096  fleet_v4.86.0_linux.tar.gz
e3bf129332a2613226e949803cb3006eea092b4aefe6de527842c9bf808781c1  fleetctl_v4.86.0_linux_amd64.tar.gz
ded8114e2bce1aacd78c794e6454dedeeea367cd06c5b8970a3096e98440c5ec  fleetctl_v4.86.0_linux_amd64.zip
6db41cc24cd30d94f8545656a9bdd00b7ff9bd2d9b27206d7ab77c2d65014cf5  fleetctl_v4.86.0_linux_arm64.tar.gz
bcc62b833e2cc0014b2e7eca8ccc8bd573be940578dcb87acf769562b240da70  fleetctl_v4.86.0_linux_arm64.zip
60a486bcbf639b4b57d36a630af6455c2d3c0878e1d74f352b71733cb990442e  fleetctl_v4.86.0_macos.tar.gz
b0f4b5d6c34cdde0366e1942d59cda5702d801c6ca1de3ae990d9df2d3bde053  fleetctl_v4.86.0_macos.zip
93d80e966adc826c206c8ebdc975f4aee35ec69cd826c9288958fb1766711a4d  fleetctl_v4.86.0_windows_amd64.tar.gz
b92a4f05267e7186eb2dc283f1c94c8cf5c7f39c4f8e1c22101ef6ec54635026  fleetctl_v4.86.0_windows_amd64.zip
e667e84db7b282601a4ae4249d2c8d6a052a1b4c2f636ff19cb062440ed95e50  fleetctl_v4.86.0_windows_arm64.tar.gz
971a0bac37a38b158e1a8a42217560560ff729982db1de2aecbe2d55a03742c4  fleetctl_v4.86.0_windows_arm64.zip

Bug fixes

• Fixed fleetctl gitops rejecting Android or Windows configuration profiles when editing an existing team, even when the corresponding MDM platform was configured.
• Implement roaring bitmaps in historical data collection for improved performance.
• Fixed dynamic SCEP certificate issuance failing with an "Invalid NDES admin credentials" error when the NDES Admin URL is fronted by Okta or another gateway that uses HTTP Basic auth instead of NTLM.
• Remove unneeded call to get tracked CVEs when reading CVE chart data

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

1aa5bbaf65833a60040fe28aa1d8b88535a025947185842c6dc6d128052f6132  fleet_v4.85.1_linux.tar.gz
1ca2b8543d5e2cb738536db75f92192c63b8bd650022b0f9ffe5b01fff3c791d  fleetctl_v4.85.1_linux_amd64.tar.gz
04d9f24669ceabad7467c40c2ca631e076a700def73291dd621c22a2dd1dad26  fleetctl_v4.85.1_linux_amd64.zip
5bd235b4840ab2fde87456267843c2ff4f29cae3fb4d431e1d0b87287d15b568  fleetctl_v4.85.1_linux_arm64.tar.gz
118dcc5a485bf1bb337496ab5bb75c6b437b8ecb9858b5ff29d405172a5cc8bd  fleetctl_v4.85.1_linux_arm64.zip
43667769f2d59e45c78d7558e05cd9350f4606681642e8238eaeea6247b7c337  fleetctl_v4.85.1_macos.tar.gz
def4fa7b8d40d6525822ef2a4e810ba8fd9b1525f6ffafa384110f4547df3fc9  fleetctl_v4.85.1_macos.zip
e7567a7e1d61cbe1a6dadc19d0c7ba6e4801dc51b9c91e58f4d303a4fe86cfdb  fleetctl_v4.85.1_windows_amd64.tar.gz
18d8861a7a0242fe2eb032b4d262c4a02411609463f0314adb7e915ccf437e03  fleetctl_v4.85.1_windows_amd64.zip
7e0ae875f2e0a86fb8cd5b746b885f10b1f6c176b404776be79a1480b21a510f  fleetctl_v4.85.1_windows_arm64.tar.gz
7c5604be0976801b00bb6bdb7199a02e10bf88bfcf3feab58011a891caf4d382  fleetctl_v4.85.1_windows_arm64.zip

Fleet 4.85.0 (May 14, 2026)

IT Admins

• Added a dark theme to the Fleet UI, selectable in account settings with light, dark, and system options.
• Implemented Clear Passcode feature for iOS and iPadOS.
• Added support for Fleet variables in Apple's declaration profiles (DDM).
• Added support for passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment, so end users are not prompted to authenticate twice when EUA is enabled.
• Switched to Docker as the default WiX runtime on macOS (including Apple Silicon) when generating .msi packages via fleetctl package. Wine is no longer required on macOS for the default path.
• Updated macOS 15 CIS benchmark to include v2.0.0 changes.
• Updated the macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0.
• Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. If this site is inaccessible, Fleet will fall back to the previous GitHub-hosted copies of manifest files.
• Added conditional HTTP downloads using ETag headers for software in GitOps, skipping re-download when content hasn't changed.
• Added always_download option for software in GitOps to bypass the new conditional download feature.
• Added automatic escaping of JSON special characters in GitOps variables used in .json configuration profiles (Apple DDM declarations and Android profiles).
• Updated fleetctl gitops to process Android certificates before Android profiles.
• Made fleet name uniqueness rules consistent across the UI, API, and GitOps paths. Fleet names must now differ by more than letter case, and conflicts return a 409 error on all code paths.
• Enabled renewing and deleting AB tokens in the UI in GitOps mode.
• Changed the team's script_execution_timeout in agent options to default to the global agent options value when unset.
• Added ability to save policies whose SQL is flagged as a syntax error.
• Withheld Android Wi-Fi configuration profiles (openNetworkConfiguration with ClientCertKeyPairAlias) until the referenced certificate is installed or terminally failed on the device.
• Updated the host OS settings detail column to show the reason when an Android profile is pending due to a certificate dependency.
• Added "Hosts online", "Vulnerability exposure", and "Hosts enrolled" charts to the dashboard.
• Added an admin setting to control retention of vulnerability-exposure data used by the dashboard chart.
• Added new policy details page with a read-only view of policy information.
• Updated edit policy page to redirect users with read-only access to the policy details page.
• Added dedicated /policies/:id/live route for running policies.

Security Engineers

• Added UI pages for creating and editing API-only users with support for fleet assignment, role selection, and API endpoint access control.
• Added new middleware (APIOnlyEndpointCheck) that enforces a 403 response for API-only users whose request either isn't in the API endpoint catalog or falls outside their configured per-user endpoint restrictions.
• Added POST /users/api_only endpoint for creating API-only users.
• Added PATCH /users/api_only/{id} endpoint for updating existing API-only users.
• Updated fleetctl user create --api-only to remove email and password field requirements.
• Added a new premium GET /api/_version_/fleet/rest_api endpoint that returns the contents of the embedded api_endpoints.yml artifact.
• Updated GET /users/{id} response to include the new api_endpoints field for API-only users.
• Added user_api_endpoints table to track per-user API endpoint permissions.

Bug fixes and improvements

• Updated Go to 1.26.3.
• Improved MySQL writer performance by skipping no-op UPDATE host_orbit_info and UPDATE host_disks writes when the stored values already match the incoming ingest values from osquery, cutting these writes to near zero at steady state.
• Improved Fleet-maintained apps (FMA) sync performance by adding an index on software.bundle_identifier that eliminates a full table scan during the hourly sync, reducing writer CPU load on large deployments.
• Improved the performance of deleting Windows MDM configuration profiles at scale by collapsing the per-profile update loop into a single batched statement that spans multiple profiles per chunk.
• Updated copy, show, and other action buttons app-wide for a more consistent style.
• Improved button and link styling.
• Improved the OS settings modal layout.
• Improved host policy empty state.
• Updated the enrollment page enroll button to render at full screen width for larger-resolution mobile devices.
• Updated the error message returned when an invalid domain is supplied for MDM Apple CSR signing.
• Updated EULA PDF upload size check to use the default max request body size.
• Added activity when a Windows MDM wipe command fails.
• Improved documentation for MySQL read replica configuration, clarifying that all settings (including region for IAM authentication) must be explicitly set for the read replica.
• Upgraded to TypeScript 6.0 for the app frontend.
• Moved some core UI form components to TypeScript for better predictability and reliability.
• Removed the unused windows_updates MySQL table and ingestion code.
• Implemented the chart bounded context and schema to support charting capabilities in Fleet.
• Added gitOpsModeEnabled and gitOpsModeExceptions to the anonymous statistics payload.
• Added startup validation that panics if any route declared in service/api_endpoints.yml is not registered in the router.
• Stopped turning on Prometheus serving by default with a hard-coded username and password when the server is started with --dev.
• Fixed a Windows BitLocker encrypt/decrypt loop on machines with secondary drives using auto-unlock. Fleet now detects disk encryption using conversion_status (not just protection_status), preventing the server from repeatedly requesting encryption when the disk is already encrypted. Added bitlocker_protection_status tracking so the UI shows "Action required" when BitLocker protection is off instead of misleadingly showing "Verified."
• Fixed a race condition where a host could silently revert to its previous team after an admin team transfer.
• Fixed an issue where trying to wipe a device after its certificate was renewed could fail due to a missing bootstrap token. Note: The device might still have wiped.
• Fixed a server panic (502) when an Android pubsub status report arrived for a host that had been deleted from Fleet.
• Fixed a server panic when an Apple MDM DeviceInformation refetch response omitted DeviceName or other expected fields.
• Fixed an issue where Fleet would send an AccountConfiguration command to iOS and iPadOS devices when end user authentication was enabled; AccountConfiguration is macOS-only.
• Fixed a bug where pending MDM profile rows persisted in the database after Apple or Windows MDM was turned off, causing stale profiles to reappear when MDM was re-enabled. Also fixed cleanup of pending Windows profile rows when a device unenrolls from MDM.
• Fixed a bug where custom package installers were not removed when adding an FMA for the same title via GitOps, which caused setup experience to install duplicate software.
• Fixed a bug where renaming a patch policy in a GitOps file caused it to be deleted initially.
• Fixed a bug where host environment variables in script-only packages would cause GitOps to fail.
• Fixed an issue where the DDM reconciler would not self-heal for stuck remove/pending profiles due to resend with update.
• Fixed an issue where a host DDM cleanup function was not executed for stale remove/pending profiles that weren't reported by the device.
• Fixed an issue where batch processing many DDM profile changes would result in stuck remove/pending profiles.
• Fixed an issue where sending a differently cased display name for a DDM profile via the batch endpoint would result in recreating the DDM profile and triggering a resend.
• Fixed an issue where Fleet would not remove the host OS setting entry if a RemoveProfile command failed with error code 89 (profile not found on device).
• Fixed an issue where adding a custom icon for a script-only package was not allowed in GitOps.
• Fixed an issue where duplicate Disk Encryption activity types showed up.
• Fixed the host details activity feed showing the previously opened host's activities by including the host ID in the activity query cache keys.
• Fixed navigation to the settings page for multi-team admin users.
• Fixed software table page number to be bookmarkable.
• Fixed an infinite page loop pagination bug on the software table page that occurred when viewing a subsequent page and then using the software filter dropdown.
• Fixed styling bugs in GitOps mode UI.
• Fixed padding between GitOps exceptions checkboxes.
• Fixed a nil pointer dereference in the contributor API spec/policies.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.55.0
2. fleet-desktop-v1.55.0 (included with Orbit)
3. osquery-5.23.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f7eed5849929b0da95b6137637ff511861c77083347b56729e64ec730ffe0fac  fleet_v4.85.0_linux.tar.gz
5ec57c4fbeea41d709a53b95cdc45c9882a0fcec540ee6817aeab8c1dee3451c  fleetctl_v4.85.0_linux_amd64.tar.gz
bee544c2a1c14f00f3704ae5b7d30e7ae4bd5eb6e83f83036787563cb96e1adc  fleetctl_v4.85.0_linux_amd64.zip
cf1c797a89ec9fdfca0faeee5e9eaf6e12abe6b2f19d1eebba721e2eb52d1075  fleetctl_v4.85.0_linux_arm64.tar.gz
97f893bb791193f6c341e6aaeb5495738d396dfd68861d0ee745083f18e70cd6  fleetctl_v4.85.0_linux_arm64.zip
ad2190195b51267eec3a935c89ea60f2fcb49ff6f85a8bd80f432664e455f56b  fleetctl_v4.85.0_macos.tar.gz
f9c5acdb0da87185cd154c653618e0dd7466267edbce33147533735b686551a6  fleetctl_v4.85.0_macos.zip
5928e8ea9652273860f7fcc0afc5689fd64df7e6fb1dde7e45b4d62af453de82  fleetctl_v4.85.0_windows_amd64.tar.gz
2229f249a7bfe0c574ea16727f2dfd8093e674d33cdb9960c28fbc17df705019  fleetctl_v4.85.0_windows_amd64.zip
07fbc541d75ef073ec18722b7cb0f7d66b89bbad85326c7fff3c27f033d408be  fleetctl_v4.85.0_windows_arm64.tar.gz
fd23af063cc59c50f125ade79d531952207595488f4c179c8efd1d5242c08411  fleetctl_v4.85.0_windows_arm64.zip

Bug fixes

• Reduced database load from GET /api/latest/fleet/device/{token}/desktop and other Fleet Desktop endpoints when invalid or expired device auth tokens are presented, by resolving the token to a host id with a single-table indexed lookup before running the multi-join host-details query.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

8323559b7c4a586beb31997c585f4000305a754d90902b42796ca84929e8c442  fleet_v4.84.3_linux.tar.gz
deaa661f852646cdbffd50d48278635717661b294c3d02279d112a787e228c1e  fleetctl_v4.84.3_linux_amd64.tar.gz
c6fb3708ea246ee05b756c242cb6f8978bd124d216b3621c2d7fb6637494afb8  fleetctl_v4.84.3_linux_amd64.zip
bce3986624a1d33badb31df1b533feafae877206ac81d3c268cc7428a8625461  fleetctl_v4.84.3_linux_arm64.tar.gz
1a0219499f50cc190949b7ad08686a49df4edb74349283e5c965aa2dc38d8859  fleetctl_v4.84.3_linux_arm64.zip
2d002968c2e2b03b1a05b7925087acce75df90e00458c91af6435e7a9ad87f73  fleetctl_v4.84.3_macos.tar.gz
5d3383af113eed7f12b75b07f8d834c6fa79299e8dce0a3f2bc7a92c10b8453e  fleetctl_v4.84.3_macos.zip
56e88759715ee94f64197869bc60799df06426493b4efa662e55bf8148b057f5  fleetctl_v4.84.3_windows_amd64.tar.gz
6f3d202f5ac908dd6261eee70ee39a9cad91f00687fa93adf13121f67d96777c  fleetctl_v4.84.3_windows_amd64.zip
d3ceac170d1f3315c71f5d71e57f288ceb73e2dc14a04414ad1f63a55286f9bf  fleetctl_v4.84.3_windows_arm64.tar.gz
6a9e17827f10c99dcddfe2d61bff309daf685159411cb4481483e1a8be4f5214  fleetctl_v4.84.3_windows_arm64.zip

Bug fixes

• Fixed filtering in /api/v1/fleet/labels/:id/hosts endpoint.
• Fixed a dead SQL condition in hostVPPInstalls that was misleading but harmless: Android VPP apps never produce nano_command_results entries (they use Google's Android Management API, not nanoMDM), so the previous (hvsi.platform != 'android' OR ncr.id IS NULL) guard was a tautology. Replaced with a clarifying comment.
• Fleet UI > Settings > Variables: Fixed access to not allow adding custom variable while in gitops mode both in the empty state and when a variable already exists
• Fixed a bug where custom package installers were not removed when adding an FMA for the same title via GitOps, which caused setup experience to install duplicate software.
• Fixed a bug where host environment variables in script-only packages would cause gitops to fail
• Updated go to 1.26.2
• Fixed an issue where trying to wipe a device after its certificate was renewed could fail due to a missing bootstrap token. Note: The device might still have wiped
• Fixed a bug where duplicate software installers for linux could be added.
• Improved validation for invalid order_key values in /api/v1/fleet/commands, /api/v1/fleet/mdm/commands and /api/v1/fleet/mdm/apple/commands endpoints.
• Fixed a server panic when an Apple MDM DeviceInformation refetch response omitted DeviceName or other expected fields.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

5bb555863948d05299e252e6df5b11914b981773f9b7e7253a1a8b2dc8d83143  fleet_v4.84.2_linux.tar.gz
1b2c7c3a320fc506de9f8b185c9d66de847e14d0d1b5ebffdc9179aeefe0c05c  fleetctl_v4.84.2_linux_amd64.tar.gz
b75e046e5fc70060e7c6383d4fe2d9b388e42367b816bee837491c3274c30000  fleetctl_v4.84.2_linux_amd64.zip
aec1812e1b406f9ac2e4694a2477902760bb3475d58506707f3626e88ef0aa12  fleetctl_v4.84.2_linux_arm64.tar.gz
b1c590f38a1992aa569783c66707986eed2418ccc557570a3bf71d249102ec86  fleetctl_v4.84.2_linux_arm64.zip
6f2d7dbdd6d51722e9373a9558fa78377c83f9b904ad5930031644d07f5e5607  fleetctl_v4.84.2_macos.tar.gz
358bc348bcf54008ac4892dc8d09553acb221b6f0f163039fd56b0ddd8e9dfa3  fleetctl_v4.84.2_macos.zip
69f8b57c80e702a9edf608dd698d3572f8a30860228a381cbbd004c4c1c3346f  fleetctl_v4.84.2_windows_amd64.tar.gz
c58b932c5aa9f003a53262a45021f3af1d94723f703cb50bf6feba8fcf9bf065  fleetctl_v4.84.2_windows_amd64.zip
ec94d3257a195336bd1a6843eaff7440a58e8a51299589725c7bb37bbb5a524a  fleetctl_v4.84.2_windows_arm64.tar.gz
425fb7a53842a0d0f0da43e1d781b5446a5817eee204edd88e94c62be77f1e6c  fleetctl_v4.84.2_windows_arm64.zip

Bug fixes

• Fixed Fleet's Docker image failing to start in Kubernetes with an unknown userid error, triggered by a fleetctl dependency side effect.
• Use Docker as the default WiX runtime on macOS (including Apple Silicon) when generating .msi packages via fleetctl package. Wine is no longer required on macOS for the default path.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

d8f4cfe973fdba253eae70d6e0c83e681d6d945ec52d37a8c9e20a887cc21c32  fleet_v4.84.1_linux.tar.gz
615567928c7e94f9cee9ae60e81852f9d300031f1e3933c5c34981f5883b9861  fleetctl_v4.84.1_linux_amd64.tar.gz
ba79ac36c7aef0e7259c9f2bc6615a42ff098b18dd4baf3564ed704c973a730b  fleetctl_v4.84.1_linux_amd64.zip
d042ff15c6c2a27eba7e992d4b11fbfd9b1dcc99b95741c6b19723601e7025cc  fleetctl_v4.84.1_linux_arm64.tar.gz
8da325cf0c2c4c729c22d4c66ab2c53c355fabb16aae1a45b43df04c8c6bfb6d  fleetctl_v4.84.1_linux_arm64.zip
75acdbd6945eb374c77cde0f65350945712cd93f9098f93bf246df88b520ae8d  fleetctl_v4.84.1_macos.tar.gz
6809e7b94fd8c99fe9f243130d1049ff4735b7c3eedb65a00d51e4526602d761  fleetctl_v4.84.1_macos.zip
72819485c95a0c7b1b765c4b64f34241d3a2712de6700c2059533427e9bded52  fleetctl_v4.84.1_windows_amd64.tar.gz
2e3cf8977a08f331fa441af11aecc0592f833f079bacdd9efb26768cd94a258e  fleetctl_v4.84.1_windows_amd64.zip
eacfbeb4cb83e8ea42fab4ea9e430ff114b6f0c7d742f781c552921b5ecdfa82  fleetctl_v4.84.1_windows_arm64.tar.gz
433efde225f9f62f95812a0b76a4335f7446210dd1d2e7319905618ff724026d  fleetctl_v4.84.1_windows_arm64.zip

NOTE FOR SELF-HOSTED: the fleetdm/fleet:v4.84.0 Docker image is broken in Kubernetes environments. Use fleetdm/fleet:v4.84.1 instead.

Fleet 4.84.0 (Apr 24, 2026)

IT Admins

• Added support for Entra conditional access to Windows devices.
• Added ability to pin Fleet-maintained apps to a specific major version in GitOps.
• Implemented ACME for MDM protocol communication, and hardware device attestation.
• Added GET /api/v1/fleet/hosts/{id}/reports endpoint (also accessible as /hosts/{id}/queries) that lists the query reports associated with a specific host.
• Added support for labels_include_all conditional scoping for software installers and apps.
• Added validation for software install, uninstall, and post-install scripts.
• Added ability to specify custom patch policy query in an FMA manifest.
• Added ability to re-send Android certificates to a specific host.
• Added Reports tab to Host details page.
• Allowed specifying a Fleet-Maintained App (FMA) as a policy software automation in GitOps.
• Added support for running python scripts on macOS and Linux.
• Added automatic retry (up to 3 times) when the Android agent reports a certificate install failure.
• Added activity logging when a certificate is installed or fails to install on an Android host.
• Enabled the host activity card on the Android host details page.
• Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. NOTE: If you limit outbound Fleet server traffic, make sure it can access the new FMA manifests location.
• Increased automatic retry limit for failed Apple (macOS, iOS, iPadOS) configuration profiles from 1 to 3. Windows profiles remain at 1 retry.
• Added a new disk_space fleetd table for macOS that reports available disk space including purgeable storage, matching the value shown in Finder's "Get Info" dialog and System Settings → General → Storage.
• Added configuration profile deletion when a Windows configuration profile is deleted or a host moves teams via SyncML <Delete> commands, bringing Windows profile removal to parity with macOS.
• Added support for outputting VPP policy automations in fleetctl generate-gitops.
• Added logging of profile names alongside MDM commands installing or removing them.
• Added indication in the UI when a profile command was deferred via NotNow status.
• Added activity when setup experience is canceled due to software install failure.
• Added cancel activities for each VPP app install skipped due to setup experience cancellation, and switched "failed" activity to "canceled" for package-based software installs in the same situation.
• Added install failure activity when VPP installs fail due to licensing issues during setup experience.

Security Engineers

• Added vulnerability detection for Microsoft 365 Apps and Office products on Windows.
• Added OSV data source for Ubuntu vulnerability scanning.
• Added automatic rotation of Mac recovery lock passwords 1 hour after the password is viewed via the API.
• Updated ingestion/CVE logic to support JetBrains software with 2 version numbers, like WebStorm 2025.1
• Addressed false positive vulnerabilities (CVE-2019-17201, CVE-2019-17202) reported for Admin By Request on macOS and Linux hosts. These CVEs are Windows-specific.
• Generated correct CPE from malformed ipswitch whatsup CPE, ensuring applicable CVEs are matched.
• Added software source to ecosystem matching to help prevent non-deterministic CPE selection when multiple vendors exist for the same product.

Other improvements and bug fixes

• Upped the default limit for the software batch endpoint, from 1MiB to 25MiB.
• Added FLEET_MDM_CERTIFICATE_PROFILES_LIMIT server config option to throttle the number of CA certificate profile installations per reconciler cycle, preventing CA server overload in large deployments.
• Added banner to Add software page to inform users that Android web apps require Google Chrome.
• Enabled Windows MDM in fleetctl preview by auto-generating WSTEP certificates on startup.
• Used the same templates for fleetctl new and new instance initialization.
• Added "API time" to GitOps output on API errors.
• Allowed clearing Windows OS update deadline and grace period fields to remove enforcement.
• Updated ordering of setup experience software to take display names into account.
• Updated iOS/iPadOS refetch logic to slowly clear out old/stale results.
• Increased the default SSO session validity period from 5 to 15 minutes.
• Improved performance of distributed read endpoint by reducing mutex contention in shouldUpdate using sync.RWMutex instead of sync.Mutex.
• Allowed OTEL service name to be overridden with standard OTEL_SERVICE_NAME env var.
• Revised which versions Fleet tests MySQL against to remove 8.0.39 and add 8.0.42.
• Allowed typing whitespace on Settings > Integrations > SSO > End users form.
• Removed incorrect report key from get/create/modify API responses.
• Added (query_id, has_data, host_id, last_fetched) index on query_results.
• Improved database query performance for the Host Details > Reports page by adding a has_data virtual generated column to query_results.
• Made sure that fleet names are trimmed and validate to prevent whitespace-only or padded names across API, gitops, frontend, and existing data.
• Hid host details > reports in the UI from platforms that do not support scheduled reporting.
• Updated GitOps label functionality to allow omitting the hosts: key under a manual label to mean "preserve existing host membership", rather than removing all hosts.
• Added Flatcar Container Linux and CoreOS to the list of recognized Linux platforms, fixing host detail queries (IP address, disk space, etc.) not being sent to hosts running these distributions.
• Updated the default fleet selected when navigating to the dashboard and to controls.
• Reduced redundant database queries during policy result submission by computing flipping policies once per host check-in instead of multiple times.
• Reduced redundant database calls in the osquery distributed query results hot path by pre-loading configuration (AppConfig, HostFeatures, TeamMDMConfig, conditional access) once per request instead of once per detail query result.
• Updated UI to use new multiplatform API keys.
• Activated warnings for deprecated API parameters, API URLs, fleetctl commands and fleetctl command options.
• Updated the Request Certificate API to return the proper PEM header for PKCS #7 certificates returned by EST CAs.
• Added "Learn more" link on End User Authentication section.
• Moved Apple MDM worker to a faster cron, and started sending profiles on Post DEP enrollment job, to speed up initial macOS setup.
• Optimized PolicyQueriesForHost and ListPoliciesForHost SQL queries by replacing correlated subqueries with a single aggregated LEFT JOIN for label-based policy scoping, reducing query time by ~77% at scale.
• Improved VPP install failure messaging to explain verification timeouts in Host details and My device install details.
• Refactored large anonymous functions into named functions to improve nil-safety static analysis coverage.
• Renamed "Custom settings" to "Configuration profiles" in Fleet UI.
• Added description to UI to help users understand which fleet a policy belongs to during add/edit.
• Updated Fleet-maintained apps to overwrite software title names on sync and when adding an FMA installer.
• Improved Fleet server performance for the Windows MDM profiles summary and host OS settings filter queries by replacing correlated subqueries with a single aggregation pass.
• Improved Windows MDM server performance at scale by reducing redundant database queries during device check-ins.
• Updated go to 1.26.1
• Fixed a server panic when uploading a Windows MDM profile to a fleet on a free license.
• Fixed MSRC vulnerability scanning to differentiate between Windows Server Core and full desktop installations, preventing false positive/negative CVEs caused by non-deterministic product matching.
• Fixed GitOps policy software resolution failing when URL lookup doesn't match, by falling back to hash-based lookup.
• Fixed GitOps failing to delete a certificate authority when certificate templates still reference it in fleet configs.
• Fixed duplicate text in error message when script validation fails when adding a custom package.
• Fixed issue where the include_available_for_install query param wasn't being applied correctly to the GET /api/latest/fleet/hosts/{id}/software endpoint.
• Fixed disk encryption key modal to not show stale key when switching between hosts.
• Fixed SCIM user not associating with host when IdP username was set before the SCIM user was created.
• Fixed Google Drive version not matching upstream.
• Fixed bug that cleared the MDM lock state if an "idle" message was received right after the lock ACK.
• Fixed team maintainers, admins, and GitOps users being unable to add certificate templates due to missing read access to certificate authorities.
• Fixed fleetd installation failure on macOS when installing it through Host details page > Software > Library as a Custom package.
• Fixed a bug where SQL queries using table aliases (e.g., FROM mounts m) incorrectly reported no compatible platforms.
• Fixed fleetctl gitops failing with "No available VPP Token" when assigning VPP apps alongside a new team.
• Fixed a bug where OS versions were not populated in vulnerability details for OS-only vulnerabilities (e.g., macOS CVEs).
• Fixed a TOCTOU-related issue when checking before deleting last admin.
• Fixed database locking issues on the policy_membership table by batching cleanup DELETE operations and moving them outside the primary GitOps apply transaction.
• Fixed success message on Android software configuration to reference software display name when applicable.
• Fixed a bug where Android host certificate template records were not cleared when a device unenrolled, causing stale certificate statuses after re-enrollment.
• Fixed a bug where the organization logo URL entered during setup was only saved for dark backgrounds and not for light backgrounds.
• Fixed an issue where setup experience items (software to install) were not enqueued for Linux distributions that did not report a "platform-like" value, e.g. Arch Linux and Omarchy.
• Fixed a bug where filtering hosts by software version for a software version not present on the selected team returned nil software instead of a lightweight report of the software.
• Fixed Fleet's usage of the incorrectly spelled 'vulnerabities' in favor of 'vulnerabilities' in MSRC bulletins.
• Fixed nondeterministic CPE matching when multiple CPE candidates share the same product name.
• Fixed a bug where Windows hosts with an empty display_version in the database would get 0 CVEs from MSRC vulnerability scanning.
• Fixed a bug where fleetctl generate-gitops failed if a Fleet-maintained app was associated to a software title with a different name (e.g. names with different versions).
• Fixed fleetctl generate-gitops failing to include VPP fleet assignments.
• Fixed query results table deduplicating rows when query data contains an id column, and fixed id column header and cell styling.
• Fixed missing underline on "Reports" nav item when active in top navigation.
• Fixed bug where adding a patch policy for a new installer in the UI caused gitops runs that didn't include that installer to fail.
• Fixed browser back button requiring an extra click to leave the Policies and Reports pages.
• Fixed a bug where Fleet continued to show a stale Recovery Lock password after a macOS host left MDM, by soft-deleting the stored password whenever the host leaves MDM (re-enrollment, CheckOut, admin unenroll, or a periodic sweep of hosts osquery reports as unenrolled) and hiding the password on the host details page until the host is enrolled again.
• Fixed an issue where silent migration status would persist even after re-enrolling the device normally, causing SCEP renewal to fail.
• Fixed issue where the "Change Management" form would reset when the page lost and regained focus.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.54.0
2. fleet-desktop-v1.54.0 (included with Orbit)
3. osquery-5.22.1 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

81f41a8040fa24d6eedb36f4e07781a1e9c7becd5230a8fbaa4838585a9d7e10  fleet_v4.84.0_linux.tar.gz
f75f2ba262a0d729b620c43a423e5821798fbdd8c9dff837b79e760ad8a49e3b  fleetctl_v4.84.0_linux_amd64.tar.gz
a6bb3ce5900159593f7baab35ded00b5f57265d5c2b3b466075ec08c8e579a98  fleetctl_v4.84.0_linux_amd64.zip
47cc6a694b3c28e39e6f5808b36656a5a8759d1e27b19bbc9e6af1c544d51c6b  fleetctl_v4.84.0_linux_arm64.tar.gz
09aa54bdff09d288b179f9f3238c6dc5a9d77f1ed706666f376f248e314568e9  fleetctl_v4.84.0_linux_arm64.zip
5d6dc8cb956937f91469e0bc24b6c65e7c3eebf10776b8ae5554f8540c1fa04c  fleetctl_v4.84.0_macos.tar.gz
7a995e9b12007a4e1453f63e8bf15fe224a283678f60424c146ceff6e57dbb57  fleetctl_v4.84.0_macos.zip
f370a39f8ebd89521f6f73fd7040ba371dfe53cd5917a5e063ab4ed3013aedc0  fleetctl_v4.84.0_windows_amd64.tar.gz
e2ec4d03889487ece6c0f786b1f2fb5bf93c82a0024f28aeba668e7f206b1c91  fleetctl_v4.84.0_windows_amd64.zip
67af88665d450fc14329fde02ef6d1ec64faaae12b7748c23bb56c1605f63eae  fleetctl_v4.84.0_windows_arm64.tar.gz
775b847ccab8fdbf9bf27b5e469fa6283b28799416761c5619f1917aaa1f453d  fleetctl_v4.84.0_windows_arm64.zip

Bug fixes

• Fixed a crash on the "My device" page for Fleet Free instances. The page returned a 402 error when the host was assigned to a team because the device endpoint called a premium-only API, and also crashed when accessing undefined policies data.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

08ef96bfc8c7b2d7650169054fa68fc9fa99a33409459d9f569859df34fb5602  fleet_v4.83.2_linux.tar.gz
9594c7a29cb210efe74eb3ac82aeeb6720a0f9a99af17197b21f7fcebbe42128  fleetctl_v4.83.2_linux_amd64.tar.gz
b6e230fe251f8f8a6a03ba3690abb012870c19944002e199a88e61f9051f4f3a  fleetctl_v4.83.2_linux_amd64.zip
46946bb498bf98f0d00265addbffba4e3a192350e6f90567021a04f679b452cb  fleetctl_v4.83.2_linux_arm64.tar.gz
0385f2981215df1e3a1ed9d1ef044066c1038a09564b2500cdda2075006e9b89  fleetctl_v4.83.2_linux_arm64.zip
8bbe2ab6244d9a04fdd555777bc9a1838cd6b988dadf4b30c45983ac0c9786aa  fleetctl_v4.83.2_macos.tar.gz
414340f61c7d31b67000311b6f91ebd0b8d4b4da280c7ffdb08cfea2ab81a0ea  fleetctl_v4.83.2_macos.zip
a52bc3bbd14cbad8227b1d68a68a0192a978381e10f70f24fb6125a0e8c7c1d2  fleetctl_v4.83.2_windows_amd64.tar.gz
0296691003856e6129a1191e8dc23d3e52f46ba627674750e533c658b5e62dc9  fleetctl_v4.83.2_windows_amd64.zip
cb009ccba74c1893607b22d57738507ff324f622d836d94f9fcf6e027dfe869b  fleetctl_v4.83.2_windows_arm64.tar.gz
d66710c52f78484b3a087c35db18d749b674f9921834bf15a299cbcd90c281b8  fleetctl_v4.83.2_windows_arm64.zip

Bug fixes

• Fixed policy creation failing when type was omitted.
• Fixed auth token not persisting when logging in via SSO.
• Fleet UI: Fixed infinite page loop pagination bug on software table page happening when viewing a subsequent page and then using the software filter dropdown to filter.
• Fleet UI: Fixed software table page number to be bookmarkable

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

441e87e397898df479f0ef2cece844a40d43954e5481e2ff5ca02b45ddf2e589  fleet_v4.83.1_linux.tar.gz
66db9fb3c7eb517afc7e6200ae5187b6697c032ba49bebd0d68cce6e34a522c1  fleetctl_v4.83.1_linux_amd64.tar.gz
3ba7302fe8d7ed6940d249163fb1f4ddedb1b83adc61928e31994482ea8d2f47  fleetctl_v4.83.1_linux_amd64.zip
c474120d20e4faedd57d8a82fc5fd9d87f29b03f0307daba1815cb6ae3c614d9  fleetctl_v4.83.1_linux_arm64.tar.gz
56f9bdb2f2532f855ef568a908a20c211b0d64afb673c5de9cec22fe5e138e51  fleetctl_v4.83.1_linux_arm64.zip
89576e2506797b631d80672f02a9e5ce7e3fc80dbcbc8a7f2db615568c158cca  fleetctl_v4.83.1_macos.tar.gz
2b28948788d53bdbf72a53e064f5de781409c4e2df2b4a0db6517ef5f905e3c5  fleetctl_v4.83.1_macos.zip
7a83a83b1cce5ca3cdf66d27fb57c0b4470797143fc2771df3ce8f405153c63d  fleetctl_v4.83.1_windows_amd64.tar.gz
4d6ef7d46b6cf2e3d1c9da8457e7c4959b2fe05f70fb39baff423d57508bbf50  fleetctl_v4.83.1_windows_amd64.zip
4eca5f033644966859eb44df73962b98d687c926ee56d83276982cf166515a7a  fleetctl_v4.83.1_windows_arm64.tar.gz
5fd20d2dc1a9a62ddb256f52ef06d707db9edb44d4005f7b955d20904df3e2cb  fleetctl_v4.83.1_windows_arm64.zip

Fleet 4.83.0 (Apr 1, 2026)

IT Admins

• Added ability to deploy an Android web app via setup experience or self-service.
• Added ability to set and manually rotate Mac recovery lock passwords.
• Added ability to lock the pre-filled user information for macOS hosts that login via End User Authentication during Setup Experience.
• Added automatic retries for failed software installs, excluding VPP apps.
• Updated host software library to always allow filtering.
• Added retry functionality when adding software installers to Fleet via GitOps.
• Added fleetctl new command to initialize a GitOps folder.
• Added support for paths: key under reports:, labels: and policies: in GitOps files.
• Added glob support for configuration_profiles in GitOps files.
• Added support for referencing .sh or .ps1 script files directly in the GitOps path field for software packages.
• Implemented webhooks_and_tickets_enabled flag for policies in GitOps.
• Added server config for allowing all Apple MDM declaration types.
• Added ability to use FLEET_JIT_USER_ROLE_FLEET_ as a prefix on SAML attributes.
• Added fleet_name and fleet_id columns to hosts CSV export.
• Added resend button in the OS settings modal for iOS and iPadOS hosts.
• Added patch policies for Fleet-maintained apps that automatically update when the app is updated.

Security Engineers

• Added support for NDES CA for Windows hosts.
• Added vulnerability scanning support for Windows Server 2025 hosts.
• Added OTEL instrumentation to Fleet's internal HTTP client.
• Added Content-Type header to Smallstep authorization requests to prevent Cloudflare from blocking them.
• Added ability to omit secrets: in GitOps files to retain existing enroll secrets on server.
• Fixed python package false positives on Ubuntu, such as python3-setuptools on Ubuntu 24.04 with version 68.1.2-2ubuntu1.2.
• Fixed false positive vulnerabilities for Mattermost Desktop.

Other improvements and bug fixes

• Most top-level keys can now be omitted from GitOps files in place of supplying them with an empty value.
• Improved host search to always match against host email addresses, not only when the query looks like an email.
• Prevented a 500 error on the host details page when an MDM command reference in host_mdm_actions pointed to a non-existent command (orphan reference).
• Allowed Fleet-maintained apps to be added if they have default categories configured that are not available in older builds from this point forward.
• Migrated to using Policy critical option when disallowing Okta conditional access bypass.
• Updated DEP enrollment flow to apply minimum macOS version check when specified.
• Updated GitOps to fail runs when unknown keys are detected in files.
• Updated default last opened time diff to 2m to increase the chances of updating the last opened time for software that is opened frequently.
• Updated the host results endpoint URL to be consistent with the other URLs.
• Added tooltip to batch run result host count to clarify that the count might include deleted hosts.
• Updated table heading and result filter styles.
• Reordered the columns on the Hosts page.
• Updated Fleet desktop to surface custom transparency links to the device user.
• Changed PostJSONWithTimeout to log response body in error case.
• Removedd unused and confusingly-named --mdm_apple_scep_signer_allow_renewal_days config.
• Refactored NewActivity functionality by moving it to the new activity bounded context.
• Modified Android certificate renewal logic to make it easier to test.
• Optimized api/latest/fleet/software/titles endpoint.
• Trimmed incoming ABM suffix for Arch Linux hosts so Arch OSs are grouped together in the database and UI.
• Updated determination process used for selecting which user email address to use when scheduling a maintenance event for a host failing policies.
• Added license checks for fleet-free targeting queries by label.
• Added APNs expiry banner in the UI for Fleet free users.
• Added error if GitOps/batch attempts to add setup experience software when manual agent install is enabled.
• Added Fleet-maintained app utilization to anonymous usage statistics collected by Fleet.
• Surfaced data constraints using the proper HTTP status code on the /api/v1/fleet/scim/users endpoint.
• Updated macOS device details UI to delay showing FileVault "action required" notifications banner during the first hour after MDM enrollment to allow sufficient time for Fleet to automatically escrow keys from ADE devices.
• Added an early return in the PUT /hosts/{id}/device_mapping endpoint so that setting the same IDP email that is already stored no longer triggers unnecessary database updates, activity log entries, or profile resends.
• Improved cleanup functionality so that when deleting a host record, Fleet will now clean up host issues, such as failing policies and critical vulnerabilities associated with the host.
• Improved the way we verify Windows profiles to no longer rely on osquery for faster verification.
• Improved body parsing validation by using http.MaxBytesReader and wrapping gzip decode output too.
• Improved rate-limiting on conditional access endpoints.
• Finished migrating code from go-kit/log to slog.
• Updated UI for disabling stored report results for clarity.
• Revised which versions Fleet tests MySQL against to 9.5.0 (unchanged), 8.4.8, 8.0.44, and 8.0.39, 8.0.44.
• Deprecated several configuration keys in favor of new names: custom_settings -> configuration_profiles, macos_settings -> apple_settings, macos_setup -> setup_experience and macos_setup_assistant -> apple_setup_assistant.
• Deprecated setup_experience.bootstrap_package in favor of setup_experience.macos_bootstrap_package.
• Deprecated setup_experience.manual_agent_install in favor of setup_experience.macos_manual_agent_install.
• Deprecated setup_experience.enable_release_device_manually in favor of setup_experience.apple_enable_release_device_manually.
• Deprecated setup_experience.script in favor of setup_experience.macos_script.
• Fixed an issue where the MDM section on the integration page did not update correctly when Apple MDM is turned off.
• Fixed an issue where iOS/iPadOS hosts couldn't add app store apps from the host library page.
• Fixed inaccurate error message when clearing identity provider settings while end user authentication is enabled.
• Fixed Microsoft NDES CA not being selectable after deleting an existing NDES CA without a page refresh.
• Fixed an issue where Apple setup experience could get stuck, if the device was in the middle of a SCEP renewal, and then re-enrolled.
• Fixed secure.OpenFile to self-heal incorrect file permissions via chmod instead of returning a fatal error.
• Fixed an issue where personal iOS and iPadOS enrollments could see software in the self-service webclip.
• Fixed table footer rendering unexpectedly in the host targets search dropdown.
• Fixed a security issue where canceling a pending lock or wipe command permanently deleted the original locked_host/wiped_host activity from the audit log. The original activity is now preserved, and the subsequent cancellation activity serves as the follow-up record.
• Fixed dropdown rendering center of a row and from pushing down save button below open dropdown options.
• Fixed end user authentication form to allow saving cleared IdP settings.
• Fixed inconsistent link styling in UI.
• Fixed the error resend button overflowing over the edge of the os settings modal table.
• Fixed CPE matching failing for software names that sanitize to FTS5 reserved keywords (AND, OR, NOT).
• Fixed table shifting left when clicking the copy hash icon in host software inventory.
• Fixed a bug where vulnerability counts increased over time due to orphaned entries remaining in the database after hosts were removed.
• Fixed a bug where software installers could create titles with the wrong platform.
• Fixed a bug where Fleet maintained apps for Windows won't show as available in the list when they actually are.
• Fixed host search in live queries returning no results for observer users when many hosts on inaccessible teams matched the search term before accessible ones.
• Fixed live query host/team targeting to correctly scope observer_can_run to the query's own team, preventing observers from targeting hosts on other observed teams.
• Fixed alignment of tooltip text in the certificate details modal.
• Fixed a bug where a policy that links a software to install fails to apply when that software package uses an environment variable in its yaml definition.
• Fixed error message when deleting a certificate authority (that is referenced by a certificate template) to show a helpful message instead of a raw database error.
• Fixed observer query bypass by restricting live query/report team targeting to only teams where the user has sufficient permissions, including global observers who are now limited to the query's own team when observer_can_run is true.
• Fixed a bug where manage hosts page header button text would wrap and distort at certain widths.
• Fixed an issue where $FLEET_SECRET was being double encoded, if set via GitOps.
• Fixed editing reports on free tier failing due to labels_include_any triggering a premium license check.
• Fixed a bug where certain incorrect resolved-in versions were reported for certain vulnerable versions of Citrix Workspace.
• Fixed DigiCert CA UPN variable substitution so each host receives a certificate containing its own unique values instead of another host's substituted values.
• Fixed alignment and spacing of the "rolling" tooltip next to "Arch Linux" in the host vitals card.
• Fixed select-all header checkbox not selecting rows on partial pages where not all rows are selectable.
• Fixed an issue where it was possible to configure manual_agent_install without specifiying a bootstrap package via the API and GitOps.
• Fixed dead rows accumulating in software host counts tables by using an atomic table swap instead of in-place updates during the sync process.
• Fixed a bug where script packages (.sh, .ps1) incorrectly used the unsaved script size limit (10K characters) instead of the saved script limit (500K characters), preventing large scripts from being added as software packages.
• Fixed an issue where Windows MDM profiles could remain in pending if hosts acknowledged them too quickly after upload.
• Fixed an issue where users with the same ID as an invited user would be hidden from the users table, and fixed the users count to include invited users.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.53.1
2. fleet-desktop-v1.53.1 (included with Orbit)
3. osquery-5.22.1 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

09ce0435cc82ee2a7b8d3370c843aa7d97dc675257bfdeda26637654c328e87e  fleet_v4.83.0_linux.tar.gz
2b2f1ce50e590303538879b8d55b5aefa4a07161c7dc2bb7349971434bc3709b  fleetctl_v4.83.0_linux_amd64.tar.gz
7756c01f50289b4ae8252e0e3b5747ba2078b5ab5ccd4918555c1ff412f5ea71  fleetctl_v4.83.0_linux_amd64.zip
a280d54a6b99cd2ea38e3781564dbd66eab7a3b4765f6b8880b32bbc0a025206  fleetctl_v4.83.0_linux_arm64.tar.gz
1df887e66bf5bc6e480d975097ee4635c8a7796951d01fc2e256e14705cff0c0  fleetctl_v4.83.0_linux_arm64.zip
b2910389ac04d6fd6b4826984277f1b7e9c9e4ad860018fe93304c733ac605ba  fleetctl_v4.83.0_macos.tar.gz
8c6c0468fa183b9482c731912406db2f4ed8a54f6c1b452a18e35e49743c0f0a  fleetctl_v4.83.0_macos.zip
16d467dcd26d867f4dccd17f8d8fc9b194cca3db2d67a54d4d5d1edbede2385b  fleetctl_v4.83.0_windows_amd64.tar.gz
6c3dca0a44a708595c0e6ba76f73f81d67e4abfbc679771011da472db6484676  fleetctl_v4.83.0_windows_amd64.zip
da28e45a3cab092ed7e1156968acaf1bb892125aa029667d8c4e5cf931afbb6f  fleetctl_v4.83.0_windows_arm64.tar.gz
b86190fb76053765ac4647d13d208244c2eae9031fb2221ad665d84e615dd4cd  fleetctl_v4.83.0_windows_arm64.zip

Bug fixes

• Fixed a metadata extraction bug for .pkg macOS installers (introduced in 4.77). It prevented updating some packages that were added in a previous Fleet version. Before this fix, deleting and re-adding the package as a workaround didn’t work. Now it does.
  • You'll know you ran into this bug if you tried updating a package and you saw this error: "The selected package is for different software".
• Fixed FMA apps not showing up for a fleet when added via GitOps after an automated FMA version update with an unchanged binary.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

c73e7ebc8418ea5407fc4f77fd7818fc9a6ef519939f28bba2d5d0a12ec7937b  fleet_v4.82.2_linux.tar.gz
d836f068c89567434a0b533e79213828dcd15733fdc1d4498a2c629c38691a76  fleetctl_v4.82.2_linux_amd64.tar.gz
fa7d4b53775ed2d0ff15a3966c71fc6c9e9e6fbecdb89915124df11424a0f305  fleetctl_v4.82.2_linux_amd64.zip
00f811ae423103a16ec78fbb7f8b70f7fcd7c9af698a987bf5e724cf6670067b  fleetctl_v4.82.2_linux_arm64.tar.gz
034755490342ac0fd9864e810c8e1ad38ac22d248370c9b80837204634967109  fleetctl_v4.82.2_linux_arm64.zip
a0afd5cb2dab1ac7ed32b2841c2b987630bcc0d8e33cba615b2c7e473a36e3b4  fleetctl_v4.82.2_macos.tar.gz
9608053f4491d5100ca88d8cfb6d11b4cd18d3b6c0e26f0e0a08c2b690b4ef09  fleetctl_v4.82.2_macos.zip
732ce2b3f1d3cd39e904ccd3a8546cf1fd94249fdaa955720236c713d55f87a9  fleetctl_v4.82.2_windows_amd64.tar.gz
f7baa714c0e3ce155a13f8fd55733f98bbbbc8361b39836a0095db6dc2e90f2b  fleetctl_v4.82.2_windows_amd64.zip
100a578c7ed57bf0d82e5b8357ba7a957e54290405ea9a5a04f3555e78e6f806  fleetctl_v4.82.2_windows_arm64.tar.gz
f65494eaf8df124e7082aea4846ccb0139bc73e7fc1d68426253540b2e8097ed  fleetctl_v4.82.2_windows_arm64.zip

Bug fixes

• Added configurable body size limits for the /api/osquery/log and /api/osquery/distributed/write endpoints.
• Fixed false positive PayloadTooLargeError errors.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

bce0a2bdd79381abb94dd04f443f241e04b1e933edbeb9f0b0df34a0ef9c24db  fleet_v4.81.3_linux.tar.gz
b0355092e52a3139cb50eae770c2815099eb47599a113222bcf3b6cf2b340aa9  fleetctl_v4.81.3_linux_amd64.tar.gz
103d5ef83efecdcd94088cf636e785e5476f19d312d01ebefe60133a048cf472  fleetctl_v4.81.3_linux_amd64.zip
c0655b309f702cddb4a749dcb50d504a8d59ce3cfc797a80adbad3a5d0eeae4f  fleetctl_v4.81.3_linux_arm64.tar.gz
6a39dda1a423de92bef0c2ab26f0aca455a168b0efd8a4656bce68192d65ef3f  fleetctl_v4.81.3_linux_arm64.zip
0dca8a860b4d8fdf3e63ac230ed6d35535fc0e41273a582965dca12d1105c926  fleetctl_v4.81.3_macos.tar.gz
b0dc4c32758843c00e838c72e0a9c643d118dd0623f59a07a20c7481c3f24885  fleetctl_v4.81.3_macos.zip
ee8bee43398232d4733d62ac9ff31748f81f9359216ab1673ec54bafdd781469  fleetctl_v4.81.3_windows_amd64.tar.gz
26d11698c033ca7fbe304ad440480d80086b081a219a04d8dbfa6224db13ba77  fleetctl_v4.81.3_windows_amd64.zip
5fe7a8394427e61d06819d4c65ed5ae98dea34977560c6db4aff58afd3934d17  fleetctl_v4.81.3_windows_arm64.tar.gz
0178565774d229634db4ab3534a5bcf778495c13392c0afd45c23cf513b7d37f  fleetctl_v4.81.3_windows_arm64.zip

Bug fixes

• Fixed a crash on the "My device" page for Fleet Free instances. The page returned a 402 error when the host was assigned to a team because the device endpoint called a premium-only API, and also crashed when accessing undefined policies data.
• Stopped duplicate Fleet-maintained app entries from showing up in setup experience.
• Reduced database contention during the vulnerability cron.
• Added a secondary index on host_software(software_id) to improve query performance.
• Fixed an issue where the "add Fleet-maintained app" endpoint incorrectly added software to the Unassigned fleet.
• Muted deprecation warnings for body params when the "deprecated-field-names" topic is not enabled.
• Fixed custom app icons not getting set via GitOps when the same software title exists in multiple teams.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

e20f5e600b04e5e76b97cc4d72d25857996401e50b30c349c33d814d25e60a17  fleet_v4.82.1_linux.tar.gz
2bf908c90db1b310e0806b614dc3d01620a36cd30771db713374023a3487cbdd  fleetctl_v4.82.1_linux_amd64.tar.gz
98daf26686fc909ca0aa396c9b379a98c4aa381b082141fa4b5a5c9143145bfe  fleetctl_v4.82.1_linux_amd64.zip
6c9701ab0fe725389aa411766ab2012972d9b7a01bb994ffb9ca65b5884c2034  fleetctl_v4.82.1_linux_arm64.tar.gz
04cb955bcccf23334a24dbe36a35d9f8a8a1b84a1948f9217653c5553f601f6f  fleetctl_v4.82.1_linux_arm64.zip
965147846622d1e4c52689fa8ee044c3dfd884b2c523c13f29a0d676b0e8bd46  fleetctl_v4.82.1_macos.tar.gz
50b332c3bfe7aaefd7dedd6537d8c347b314786b6f90494176f807a75977455d  fleetctl_v4.82.1_macos.zip
740ddd324b592b0e48a0ecd25d8da9df9eb889439e9b23c4fbc45e9cf80b972a  fleetctl_v4.82.1_windows_amd64.tar.gz
5913036d550e30bedafc6f309f0a72058b6e45e65b5d247a0b056f3f2ff71c60  fleetctl_v4.82.1_windows_amd64.zip
b348a265022cd1311db5cd4a8a4faf754ce155dee2360e7e86a5caf4bfcfc64b  fleetctl_v4.82.1_windows_arm64.tar.gz
18330c5416c54739beddfb23d49f4cc9daa30de6e226d2cff3407738477db07e  fleetctl_v4.82.1_windows_arm64.zip

Fleet 4.82.0 (Mar 11, 2026)

IT Admins

• Added support for enrolling fully managed Android hosts without a work profile.
• Added capability to uninstall Android apps on the device (and removal from self-service in the managed Google Play store) when an app is removed from Fleet.
• Added ability to allow or disallow end-users to bypass conditional access on a per-policy basis.
• Added filtering by platform and add status to the Software > Add Fleet-maintained apps table.
• Updated Android status reports to re-verify profiles that previously failed.
• Added ability to roll back to previously added versions of Fleet-maintained apps.
• Added new Technician role designed for help desk and IT support teams. Technicians can run scripts, view results, and install or uninstall software.
• Added support for JIT provisioning of the Technician role via SSO SAML attributes.
• Added automatic retries for failed software operations.

Security Engineers

• Added ability to scan for kernel vulnerabilities on RHEL based hosts.
• Added AWS GovCloud RDS CA certificates to the RDS MySQL TLS bundle, enabling IAM authentication for Fleet deployments connecting to RDS in AWS GovCloud regions (us-gov-east-1, us-gov-west-1).
• Added CVE alias for python visual studio code extension.
• Added new activity for edited enroll secrets.

Other improvements and bug fixes

• Renamed teams and queries to fleets and reports in the UI, API, CLI, and GitOps.
• Deprecated no-team.yml in GitOps in favor of unassigned.yml.
• Deprecated certain API field names to reflect the renaming of "teams" to "fleets" and "queries" to "reports".
• Updated Android MDM profiles to show up as pending on upload, the same as Apple MDM profiles.
• Improved the speed of a database query that runs every minute to avoid database locking.
• Added configurable body size limits for the /api/osquery/log and /api/osquery/distributed/write endpoints.
• Updated logic to trigger vulnerability webhook when on Fleet free tier.
• Updated storage of the auth token used in the UI.
• Dynamically alphabetized vitals on the host details page.
• Reworked how we handle server/worker delays to fix flaky tests.
• Disabled "Calendar" dropdown option in Policy > Manage automations for Unassigned.
• Added Go slog logging infrastructure and migrated a portion of the code from go-kit/log to slog.
• Added CTA to turn on Android MDM for Android software setup experience if MDM is not configured.
• Left-aligned "Critical" checkbox in Save policy form.
• Improved spacing on the Controls > OS Settings page.
• Updated to not allow editing Fleet-maintained app in the UI while GitOps mode is enabled.
• Updated to accept the previous device authentication token for up to one rotation cycle, so the My Device page URL remains valid after token refresh.
• Updated default macOS, iOS, and iPadOS update deadline time to 7PM (19:00) local time.
• Updated UI to enable adding/removing multiple Microsoft Entra tenant ids.
• Added additional logging for SCEP proxy requests and SCEP profile renewals.
• Added warning message on gitops label rename to clarify to users that renaming a label implies a delete operation.
• Added the ability to specify allowed Entra tenant IDs for enrollments.
• Updated the DEP syncer to properly reassign a profile when ABM unilaterally removes it.
• Increased the maximum script execution timeout from 1 hour (3600 seconds) to 5 hours (18000 seconds).
• Improved error handling on AWS DB failover. Fleet will now fail health check if the primary DB is read-only, or trigger graceful shutdown when write operations encounter read-only errors.
• Generated a server-side device token in the Okta conditional access flow when none exists or the current token is expired.
• Moved the copy button for text areas out of the text area itself and in line with its label.
• Removed unnecessary calls to svc.ds.BulkSetPendingMDMHostProfiles in POST /api/latest/fleet/spec/fleets.
• Internal refactoring: moved /api/_version_/fleet/hosts/{id:[0-9]+}/activities endpoint and MarkActivitiesAsStreamed to new server/activity bounded context.
• Added logging.otel_logs_enabled contributor config option to export server logs to OpenTelemetry.
• Added automatic tagging of prerelease/post-release versions on local build based on branch name.
• Added ability to enable/disable logs by topic.
• Improved detection of DISPLAY variable in X11 sessions.
• Updated the "Used by" column heading on the hosts page to "User email".
• Refactored query used for deleting host_mdm_apple_profiles in bulk to use Primary keys only.
• Added team_id to host details page param in URL to allow retaining team on refresh.
• Added help text on the software details page, below the installer status table, to explain the meanings of the counts.
• Added Country:US to new CA certs created by Fleet.
• Added error if GitOps/batch attempts to add setup experience software when manual agent install is enabled.
• Updated "Manage automations" button on the Queries and Policies pages to now always be visible, and disabled only when the current team has no queries of its own.
• Updated validation rules around the creation of labels to make sure only valid platforms are used.
• Improved host software inventory table's handling of long "Type" values.
• Updated expiration date of the auth token cookie to match the fleet session duration.
• Surfaced FMA version used and whether it's out of date in the UI.
• Updated nats-server dependency to resolve dependency vulnerabilities.
• Improved validation for host transfers.
• Fixed matching logic on App component for pages titles.
• Fixed adding Windows Fleet maintained apps failing when a software title with the same upgrade code already exists.
• Fixed an issue where GitOps would not respect the value set on update_new_hosts for macOS updates.
• Fixed an issue where duplicate kernels were reported in the OS versions API for RHEL-family distributions (RHEL, AlmaLinux, CentOS, Rocky, Fedora).
• Fixed issue where Windows Jetbrains products would not report the correct version number.
• Fixed a bug where custom software installer display names and icons were not used in the setup experience UI.
• Fixed a bug where the list activities API endpoint would fail with a database error when there were more than 65,535 activities and no pagination parameters were specified. The maximum per_page for activities endpoints is now 10,000.
• Fixed issue where MySQL IAM authentication could fail when a custom TLS CA/TLS config was set (for example GovCloud), by ensuring Fleet includes the configured TLS mode in IAM DSNs.
• Fixed styling issues for the UI when no enroll secret is present on a fleet.
• Fixed an issue where some UI users saw a blank gutter on the right side of parts of the UI.
• Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal.
• Fixed install/uninstall tarballs package to skip recently updated status that is waiting for a change in software inventory
• Fixed a bug where software installers could create titles with the wrong platform.
• Fixed a bug where 2 vulnerability jobs can run in parallel if one is taking longer than 2 hours.
• Fixed issue with hosts incorrectly reporting policy failures after policy label targets changed.
• Fixed client-side errors being incorrectly reported as server errors in OTEL telemetry.
• Fixed issue where the status name was wrapping at smaller viewport widths on the mdm card on the Dashboard page.
• Fixed false negative CVE-2026-20841 on Windows Notepad.
• Fixed false positive CVE for Nextcloud Desktop.
• Fixed rare CPE error when software name sanitizes to empty (e.g. only special characters).
• Fixed Android enrollment to associate hosts with SCIM users, populating full name, groups, and department in host vitals.
• Fixed a hover style issue in the label filter close button.
• Fixed mismatches between disk encryption summary counts vs hosts displayed.
• Fixed truncation of certificate fields containing non-ASCII characters.
• Fixed an issue where policy automation settings in the Other Workflows modal reverted to stale values after saving when using a MySQL read replica.
• Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
• Fixed DB lock contention during vulnerability cron's software cleanup that caused failures under load.
• Fixed pagination on the host software page incorrectly disabling the "Next" button when a software title has multiple installer versions.
• Fixed a bug where macOS systems previous enrolled in fleet wouldn't always go through setup experience after a wipe
• Fixed stale software titles list after adding a VPP or fleet-maintained app by invalidating the query cache on success.
• Fixed issue where Windows Jetbrains products would not report the correct version number.
• Fixed false positive PayloadTooLargeError errors.
• Fixed software appearance edits not reflected until page refresh.
• Fixed issue where policy automation retries were potentially reading stale data from replica database.
• Fixed label edits not reflected until page refresh.
• Fixed report creation API returning zero timestamps for created_at and updated_at fields.
• Fixed issue where arbitrary order_key values could be used to extract data.
• Fixed stale software titles list after deleting a software installer.
• Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.53.0
2. fleet-desktop-v1.53.0 (included with Orbit)
3. osquery-5.21.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

c7a65efcb286dca140ed390e34eefa4eb87c72cf1adaae476cd606087bec522e  fleet_v4.82.0_linux.tar.gz
8994021172c144e3fe361d33e8d3820d39128838797a8ace502309720c808334  fleetctl_v4.82.0_linux_amd64.tar.gz
3d8691ce8c88702aaa5c22b8f05a3c930a41e76dde0799280f42525039a28240  fleetctl_v4.82.0_linux_amd64.zip
c3d6c8f6afc73baa1d9af18903f25bdbae282b948b53acb1b4bc7cf5218b6d0e  fleetctl_v4.82.0_linux_arm64.tar.gz
0463b1ce392444076dfc5de66cca4e9b35ea61dc3813ca92c1fe94d13b04d162  fleetctl_v4.82.0_linux_arm64.zip
adb9e9e657972eec2e358640f94c2abfb3e444f745d3b8b181d31b5f4645301f  fleetctl_v4.82.0_macos.tar.gz
30f484ede205ccce287da53cfcd6cd18d4f9103c9eaebe75d602b08c44d3a3f7  fleetctl_v4.82.0_macos.zip
9286933a93255e31c4f5f673c63feb1a4cd6629e06ede172b8d3514c155acab6  fleetctl_v4.82.0_windows_amd64.tar.gz
4cf624121914bbe66b8f6b6f5b2e61dee37f9c097f80be6d5b434467aad31d39  fleetctl_v4.82.0_windows_amd64.zip
3da0f7e1aa0975ce0d4f21b0e4e64b2c228debc8df0a4602c2e673c067364a3a  fleetctl_v4.82.0_windows_arm64.tar.gz
010ca1284bc99d9870432b2323c5bdefae9f4b57b2b9848b0fa98a18b3eff78a  fleetctl_v4.82.0_windows_arm64.zip

Bug fixes

• Fixed a bug where macOS systems previous enrolled in fleet wouldn't always go through setup experience after a wipe.
• Fixed issue where policy automation retries were potentially reading stale data from replica database.
• Updated the DEP syncer to properly reassign a profile when ABM unilaterally removes it

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

33221c6628170521ba5da1103ea095bd8ca912429f7304111be49f50b3583fcb  fleet_v4.81.2_linux.tar.gz
8b23b40e0e05ab9bd40f662d539409d5cb2a08fdf22dca335e3fadb2808487c6  fleetctl_v4.81.2_linux_amd64.tar.gz
f3c9477428f7497de2a50af243ad0c1c9e305ba9e3ca8f9da22f0dd2b2ce80a5  fleetctl_v4.81.2_linux_amd64.zip
78720604057ff3da7ddc4afeb7c5d3cb82405b52d3df004db8327e0a38034476  fleetctl_v4.81.2_linux_arm64.tar.gz
a11b57408429266f247179e4b9d11b986d800773767721dd3bd69f1168231393  fleetctl_v4.81.2_linux_arm64.zip
a8ccd31eb28c7abb7427d2dbf7dc580e12717c4a23dea9bdc69353ccad4cbc4b  fleetctl_v4.81.2_macos.tar.gz
aa6c07d0c47af24982c3de846ed75b23f0bb49e98a9fb525fef4e1322440703d  fleetctl_v4.81.2_macos.zip
6528dbd77c9fa2231139875fc3bc91478c25d5f6cbb258de1c01fbb8b3550e34  fleetctl_v4.81.2_windows_amd64.tar.gz
84b5c6631a0cffaf018d856d629fcd4023e9957e6248f40da0f9fdece5b4f52f  fleetctl_v4.81.2_windows_amd64.zip
dca40c88bf2668a642b9be03d5c683222abbd0e91481255e21b5b99664c2615d  fleetctl_v4.81.2_windows_arm64.tar.gz
e6415227de8f2c7b97d16a4f7bf060664f69ef0d3b117106840851a06524ebaf  fleetctl_v4.81.2_windows_arm64.zip

Fleet 4.81.1 (Mar 2, 2026)

Bug fixes

• Fixed an issue where some UI users saw a blank gutter on the right side of parts of the UI.
• Updated UI to enable adding/removing multiple Microsoft Entra tenant ids.
• Fixed a hover style issue in the label filter close button.
• Fixed false positive CVE for Nextcloud Desktop.
• Fixed rare CPE error when software name sanitizes to empty (e.g. only special characters).
• Fixed false negative CVE-2026-20841 on Windows Notepad.
• Fixed issue with hosts incorrectly reporting policy failures after policy label targets changed.
• Updated storage of the auth token used in the UI; move if from local storage to a cookie.
• Improved spacing on the Controls > OS Settings page.
• Added the ability to specify allowed Entra tenant IDs for enrollments.
• Added CTA to turn on Android MDM for Android software setup experience if MDM is not configured.
• Added CVE alias for Python Visual Studio Code extension.
• Improved validation for host transfers.
• Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
• Moved the copy button for text areas out of the text area itself and in line with its label.
• Fixed some styling issues for the UI when no enroll secret is present on a fleet.
• Left-aligned "Critical" checkbox in Save policy form.
• Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
• Fixed matching logic on App component for pages titles.
• Fixed issue where the status name was wrapping at smaller viewport witdths on the mdm card on the Dashboard page.
• Disallowed editing Fleet-maintained app in the UI while GitOps mode is enabled.
• Fixed error handling on failed VPP install commands not initiated by Fleet VPP app installation.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

788cda125084fe897ee9bdc25ab37ae7d2af2d75ff8ac3903dfb99e6e3c19ebf  fleet_v4.81.1_linux.tar.gz
bb988a67614d8d2c7d39b44a52603f485b4bb457adc48e650889a3fc49930567  fleetctl_v4.81.1_linux_amd64.tar.gz
7d02c52467866a9a47e964690af9e34965b54ade09128d4e343f70378ff74c38  fleetctl_v4.81.1_linux_amd64.zip
40114d99dd63f8ebb3942c879d74c64e31bba230b7b14290f94c7d11cd8fdf5d  fleetctl_v4.81.1_linux_arm64.tar.gz
98d1ac9e4340820ae90f051e7b34c9e533defbd81e831fb2c9705b2133942a6b  fleetctl_v4.81.1_linux_arm64.zip
f9e48f32708ab5d91e136b7a1f951cd97075221c0a168165f6e9acb8bb8b56a8  fleetctl_v4.81.1_macos.tar.gz
2cdc32a926b7d64a72742bd4e89cd88c57b092d3257741b78d9aac17913a7ac5  fleetctl_v4.81.1_macos.zip
e14bdd333bf308776ee5da69c74abe04cf60ee504c343acf539f6e23edccfa37  fleetctl_v4.81.1_windows_amd64.tar.gz
9eece89fecb34f2c600774847a0daaeabd94f7ee6c6e68fabc4d8ef2a33edf09  fleetctl_v4.81.1_windows_amd64.zip
1df0878f3bf750e68aa3f9a7e58d7e3cde5d2aee459d80ba1fa355468e35b7ea  fleetctl_v4.81.1_windows_arm64.tar.gz
366fd322ad0121add63fe65f49276b4fc225bf3e9eed2394ae203cb1add690c9  fleetctl_v4.81.1_windows_arm64.zip

Fleet 4.80.3 (Feb 20, 2026)

Bug fixes

• Fixed validation and error handling issues.

Fleet-maintained app updates and vulnerability feed fixes are applied, whether or not you upgrade.

Fleet's agent and fleetctl CLI

The following version of Fleet's agent (fleetd) and fleetctl support the latest changes to Fleet:

1. orbit-v1.52.1
2. fleet-desktop-v1.52.1 (included with Orbit)
3. osquery-5.21.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd and fleetctl still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

c83b87c6cddf052c4b44798d1d618563f7e965201cbe9c11638a5b72ad2a6a2c  fleet_v4.80.3_linux.tar.gz
a0cf0ead01feda43be097d0ce868ac56d5473885ef51b76be82f3bd7c7dcda0c  fleetctl_v4.80.3_linux_amd64.tar.gz
6c39466958adbe599a412059702ddce3868b9799da611112e8b9c4f77888b87f  fleetctl_v4.80.3_linux_amd64.zip
e8f983a032bf602aaa51332528aa88d50590ad317518ec0325bb2b52416fd745  fleetctl_v4.80.3_linux_arm64.tar.gz
d7c615162205455dbb097a1e3a5c28e78d27eba503777b54273b9224648258c7  fleetctl_v4.80.3_linux_arm64.zip
8b3e22ed1ba700d89e0d1783e200f64bb5501ee878d6cd0776c0be531bdba046  fleetctl_v4.80.3_macos.tar.gz
47fed78d73ecd1307ecad2589193e5532b870f5dc8707a1d9796c97a3218d718  fleetctl_v4.80.3_macos.zip
a5a86cf892f5bc32242ddc74085669e033ba5a6c350928a1c29be97281422092  fleetctl_v4.80.3_windows_amd64.tar.gz
396d990f3cd5ff2b9ee2a73393f3a54b092e58cda3d9af2387f83f11969674a4  fleetctl_v4.80.3_windows_amd64.zip
adebdb0c9dddfdd3a7db335c018e2d5dcb9e8aac96b3c4927ed082cd6cab2f9d  fleetctl_v4.80.3_windows_arm64.tar.gz
ad59b2d4d6a45b235848663d3fff566fec758f0b03b4e9b8718de3981794d070  fleetctl_v4.80.3_windows_arm64.zip

Fleet 4.81.0 (Feb 20, 2026)

IT Admins

• Added support for dynamic SCEP challenges for Okta certs.
• Added a feature to allow IT admins to specify non-atomic Windows MDM profiles.
• Added GitOps support to fleet yaml to apply display_name to software package.
• Added enrollment support for iPod touch.
• Added hash_sha256 and package_name query parameters to the GET /api/v1/fleet/software/titles endpoint to allow checking if a custom software package already exists before uploading. Both parameters require team_id to be specified.
• Added ability to set default URL for Fleet Desktop.
• Added logic to skip setup experience for hosts that were enrolled > 1 day ago.
• Updated maximum software installer size to be configurable and bumped the default from 3 GB to 10 GiB.
• Added a check to fail any pending in-house app installs and cancel upcoming activities when unenrolling a host.
• Added gzip_responses server configuration option that allows the server to gzip API responses when the client indicates support through the Accept-Encoding: gzip request header.
• Allowed specifying an Apple Connect JWT for interacting directly with Apple APIs when retrieving VPP app metadata.
• Added logic to .pkg metadata extraction to match the root bundle identifier.
• Moved Windows automatic enrollment configuration instructions out of the UI and into the Windows MDM setup guide.

Security Engineers

• Added conditional_access.cert_serial_format server option to allow specifying the Okta conditional access certificate serial format.
• Improved authentication of POST /api/v1/osquery/carve/block requests by parsing and validating session_id and request_id before processing data.
• Redirected users to device policy page when failing conditional access requirements.
• Limited disk encryption key escrowing when global or team setting enabled.
• Differentiated IMP and Integrative Modeling Platform (IMP) while running vulnerability scanning.
• Fixed false negative for Adobe Reader DC CVE-2025-54257 & CVE-2025-54255.

Other improvements and bug fixes

• Added an environment variable to allow reverting to the old behavior of installing the bootstrap package during macOS MDM migration.
• Added --with-table-sizes option to prepare command to get approximate row counts of all database tables after a migration completes.
• Updated Fleet UI so that if software is detected as installed on software library page, hide any Fleet install/uninstall failures from page. Admin can view these failures from host details > activities.
• Updated Android certificate app to re-enroll if the host was deleted in Fleet.
• Updated fleetctl generate-gitops to output Fleet-maintained apps in a dedicated fleet_maintained_apps section of the YAML files.
• When a host is deleted, any associated VPP software installation records are also deleted.
• Global observers and maintainers can now officially read user details, which were already visible to them via the activity feed.
• Iru (Kandji's new name) added to the list of well-known MDM platforms.
• Improved error message when viewing disk encryption key fails because MDM has been turned off and the decryption certificate is no longer valid.
• Updated UI to show VPP version for adding software during setup.
• User sessions and password reset tokens are now cleared whenever a user's password is changed.
• Disallowed use of FLEET_DEV_* environment variables unless --dev is passed when serving Fleet.
• Handled the NotNow status from the device during DEP setup experience so it does not delay the release of the device.
• Allowed overriding individual configuration variables for MySQL and object storage when --dev is passed when serving Fleet.
• Updated DEP syncing code to use server-protocol-version 9 and handle THROTTLED responses.
• Updated UI styling to the Packs flow.
• Surfaced Google error message for Android profile failures after max retries instead of a generic error.
• Optimized recording of scheduled query results in the database.
• Improved API error message when adding profiles or software with non-existent labels.
• Ignored parenthesized build numbers in UI when comparing versions for update availability (e.g. 5.0 (build 3400)).
• Improved DEP process cooldowns, by limiting how many we process in a single as per Apple's recommendations.
• Improved OpenTelemetry tracing: added proper shutdown to flush pending spans, and added service name/version resource attributes for better trace identification.
• Improved OpenTelemetry error handling: client errors (4xx) no longer set span status to Error or appear in the Exceptions tab, following OTEL semantic conventions. Added separate metrics for client vs server errors (fleet.http.client_errors, fleet.http.server_errors) with error type attribution. Client errors are also no longer sent to APM/Sentry.
• Internal refactoring: introduced activity bounded context as part of modular monolith architecture. Moved /api/latest/fleet/activities endpoint to new server/activity/ packages.
• Removed a debug-level warning asserting that macOS devices were unauthenticated when enrolling to Fleet.
• Updated gitops related tests to validate that users can get/set the alternative browser hosts fleet desktop setting.
• Updated to Go 1.25.7.
• Fixed a bug with the PATCH /software/titles/{id}/package where the categories could not be updated by themselves, another field had to be updated for them to be modified.
• Fixed an issue setting the bootstrap package on teams created by the puppet plugin.
• Fixed an issue where enabling manual agent installation for macOS devices would incorrectly block the addition of setup experience software titles for all platforms.
• Fixed Smallstep CA integration to send Authorization header with first request.
• Fixed an issue where deleted Windows and Linux hosts could re-enroll without re-authenticating when End User Authentication was enabled.
• Fixed a permission issue on software installer custom icons where a team maintainer could not view, edit or delete a custom icon.
• Fixed bug where unfinished Entra Integration setup breaks the UI.
• Fixed SCEP proxy so that it uses standard base64 encoding for PKIOperation GET requests, ensuring compatibility with standard SCEP servers.
• Fixed an issue where queries with common table expressions (CTEs) were marked as having invalid syntax.
• Fixed a bug where installing Xcode via VPP apps on macOS resulted in a failure due to not being able to verify the install.
• Fixed a bug where non utf8 encodings caused an error in pkg metadata extraction.
• Improved error message where there is issue getting the enrollment token during ota enrollment.
• Fixed CVE false positive on ninxsoft/Mist.
• Fixed an issue where last_install details were not returned in the Host Software API for failed software installs, preventing users from viewing failure information.
• Fixed saving of policy automation in UI that triggers software installs and script runs.
• Fixed a bug where changes to scripts were causing custom software display names to be deleted.
• Fixed bug where custom icons were ignored for fleet maintained apps in GitOps files.
• Fixed panic in gRPC launcher API handler.
• Fixed a bug where installed software would not show up in the software inventory of an ADE-enrolled macOS host after a wipe and a re-enrollment.
• Fixed issue where MySQL read replicas were not using TLS.
• Fixed bug where fleetctl gitops was not sending software categories correctly in all cases.
• Fixed an issue in fleetctl gitops that would reset VPP token team assignment when using "All teams".
• Fixed bug in host activity card UI where activities related to MDM commands should be hidden when Apple MDM features are turned off in Fleet.
• Fixed unnecessary error logging when no CPE match is found for software items like VSCode extensions and JetBrains plugins.
• Fixed created_at and updated_at timestamps on API responses for Label and Team creation.
• Fixed issues where different variations of the same software weren't linked to the same software title.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.52.1
2. fleet-desktop-v1.52.1 (included with Orbit)
3. osquery-5.21.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

5a02732037853669a1114c0c30e6a7475cc7cba71aea80e56ab9724842296721  fleet_v4.81.0_linux.tar.gz
366a04a50706741fc3e0bb382239d9088918af637d45c493edfa271cc91a26e7  fleetctl_v4.81.0_linux_amd64.tar.gz
b6f0026ee342c3465855b77d90f7cb1c705f4d34f98898967fd3523dea5add72  fleetctl_v4.81.0_linux_amd64.zip
b1e56569e931b09d336a9c01d8b70378a09707e53aa0799121f69aeb701c95fd  fleetctl_v4.81.0_linux_arm64.tar.gz
d3045c717970e7b9f2d0789910d0d316bcd78eb783c3630da4ae92755f9367a1  fleetctl_v4.81.0_linux_arm64.zip
5ee195aee4aeb267ac7f7fffd010bf02d7ddf6df1eac71b073a52062ee85485f  fleetctl_v4.81.0_macos.tar.gz
49b0ea207ae0d2871947ff593a42ef31a10e484a3412a6979395667cb76e5f55  fleetctl_v4.81.0_macos.zip
59b0041e4b329c5291fdd6f948740788f797680f9616205cf4c53cd6cbcc39be  fleetctl_v4.81.0_windows_amd64.tar.gz
35d18bb6f5691e5422d0096b3061e4cb6caa81b5784d977aa9280f5d326cd500  fleetctl_v4.81.0_windows_amd64.zip
cc338e664825d406e5d4ea06de107dd2d2de535747d98ebca6e6613853bf5d97  fleetctl_v4.81.0_windows_arm64.tar.gz
0ca7f23a157358d465f6cf59a63c81d26f9ffac73277ca9587fbd7f3bd23f770  fleetctl_v4.81.0_windows_arm64.zip

Bug fixes

• Updated to Go 1.25.7.
• Fix issue where MySQL read replicas were not using TLS.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

ba950de7d2fb79f852cf43b5865e5c795a149f7a70b8d7ea741d2544b8ecfd6e  fleet_v4.80.2_linux.tar.gz
c4ada390ef700218cc9f665a5c7d1fbbdb891282af50401c48870f9764828705  fleetctl_v4.80.2_linux_amd64.tar.gz
6c83720b1abef156c95a20faddf5c84205f98025a2da2287b9ff595ba348cd45  fleetctl_v4.80.2_linux_amd64.zip
762b1b2b4f03bf99be87ddf9c2294b0ae95ef9e90da3fe139c2a6fb5df4c9ed2  fleetctl_v4.80.2_linux_arm64.tar.gz
bc8b9fa27095debd1a4d1b52508b66bbff0ca96e76b8255d2ecd870bd706c857  fleetctl_v4.80.2_linux_arm64.zip
a76588288387188b5756c042377c4eadc6ab38ab971871770f778d75af5edf66  fleetctl_v4.80.2_macos.tar.gz
149f90613a279dc0e20a84e83982f6f06b7d3d1174cca0353e7a9e3df281eaee  fleetctl_v4.80.2_macos.zip
62f322d0e2618df5cd1f775be2699eb185c45c38fef23f01e61756adaafd6f43  fleetctl_v4.80.2_windows_amd64.tar.gz
2d319d5d294d28d12d8d4da7f4dca2d9c73b5582b055f17371387e5983157e87  fleetctl_v4.80.2_windows_amd64.zip
52ab9120599d646595e525c6e8d5510b45a06dd1a344f7b47e50bc5298d24563  fleetctl_v4.80.2_windows_arm64.tar.gz
9156bbc099ca4bdddd55804ca2469f415c6deeb3817e6becc3648ffc104ae97b  fleetctl_v4.80.2_windows_arm64.zip

Fleet 4.80.1 (Feb 06, 2026)

Bug fixes

• Optimizing certificate template batch delete auth
• Updated refetch logic for iPhone and iPad to only fetch location data if the host is locked.
• Fleet UI: Allow users to scroll through disabled yml fields
• Fleet UI: Update icon buttons for consistency
• Fleet UI: Fixed broken disk space sort header on hosts table
• Fleet UI: Fixed hover color of links in error flash messages
• Fleet UI: Clarify what happens to pending software installs when deleting VPP apps
• fixed an issue where fleetctl generate-gitops would panic if the google calendar integration was enabled
• Fixed false positive for CVE-2023-41036 for macvim
• the google calendar intergration api key json is now obfuscated in GET requests
• Fixed a UI bug where the host list was being pushed down when viewing with a platform filter.
• Fixed false negative CVE for 7-Zip installed with MSI installer.
• fixed libtiff false positive vulnerability
• Fixed CVE false positives for Microsoft 365 companion apps by targeting Microsoft 365 better
• Fixed a bug where certain iOS/iPadOS devices (enrolled prior to Fleet v4.68.0) are unable renew their enrollment profiles because of mismatched server URLs (specifically, this bug occurs if the URL in the original enrollment profile contains an enroll_reference query parameter).
• Added the FLEET_SERVER_TRUSTED_PROXIES configuration. Updated lock modal for iPad hosts to display iPad screenshot in the end user experience section Fixed false negative CVE for pgAdmin 4.
• Fixed git & gitk cve attributions due to mismatch between homebrew packaging and nvd feed attribution
• Fixed false positives for Safari CVE-2023-28205
• Fixed styling issues with long script names.
• Show error reason when trying to create or edit a label that conflicts with a built-in label name
• Fixed bug where certificate template parameters where not serialized

Fleet 4.80.0 (Feb 2, 2026)

IT Admins

• Added ability to automatically uninstall managed apps when iOS/iPadOS devices are unenrolled from MDM.
• Added ability to schedule automated software updates for iOS/iPadOS VPP apps via the Fleet admin interface.
• Added the ability to get and set auto-update schedule for VPP apps via the API.
• Added scheduled updates functionality to iOS/iPadOS managed devices.
• Added custom VPP apps to available VPP apps listing.
• Added support for in-house apps to use Cloudfront signed URLs in manifest if Cloudfront is configured.

Security Engineers

• Added NATS as a logging destination.
• Updated NDES SCEP proxy to auto-detect response encoding, enabling compatibility with Okta CA and other UTF-8-based CAs.
• Implemented ingesting, persisting, and serving the sha256 hash and path for the CFBundleExecutable binaries of .app bundles on macOS.

Other improvements and bug fixes

• Added validation and harmonized the error message displayed when an installer (FMA, custom package, VPP app, in-house app) conflicts with another one on the same team targeting the same platform.
• Randomized APNS query to ensure all pending Apple hosts gets a push notification.
• Updated macOS bootstrap package to no longer install during MDM migration, only initial setup.
• Updated script and software installer policy automations will retry up to three times if attempts to run them fail.
• Improved host status tag styles on host details page.
• Improved error message for user-scoped profiles on iOS/iPadOS hosts.
• Surfaced Queries within the Details tab on the Host Details page.
• Updated software ingestion of manually-enrolled (BYOD) iPhone/iPad devices to only ingest (and display in software inventory) Fleet-installed software.
• Omitted software last_opened_at in API responses when the data source does not support it. Return an empty string when the source does have support but there is no value.
• Updated UI for Controls > Setup experience > Install software > Android to fix inconsistent loading state.
• Updated UI to show a generic error message when attempting to delete setup experience software.
• Improved error message when trying to apply certificate authorities via gitops without the correct license.
• Added space trimming of displayVersion when processing VPP apps (found in some production apps).
• Updated software version search to now include results that match the software title name in addition to the version name.
• Adjusted the read-only SQL editor to appear non-interactive.
• Added information about auto-update configuration to the "edited_app_store_app" activity.
• Refactored common endpoint_utils package to support bounded contexts inside Fleet codebase. Moved it to server/platform/endpointer.
• Updated UI to inform admins of the need to accept terms and conditions for multiple Apple Business Manager accounts.
• Removed Queries tab from Host Details page.
• Revised software batch upload timeout to be 4 minutes, refreshed as every software package is downloaded from source or uploaded to object storage, from 24 hours, allowing for quicker detection of when a software batch fails due to the underlying server going offline.
• Added a tooltip to an expired ABM token and also correctly removes the banner when an expired ABM token is deleted.
• Updated error message to clarify that Fleet requires Apple (macOS, iOS, and iPadOS) configuration profiles have a unique identifier (PayloadIdentifier) and scope (PayloadScope) across teams.
• Renamed "Disk space" to "Disk space available" in Host details > Vitals.
• Truncated long strings (Operating system and Hardware model) in Host details > Vitals.
• Rolled back the change to ingest legacy Entra "device ID" from the keychain (for silent migrations) because it's not supported by Entra. Refactored common_mysql package to support bounded contexts inside Fleet codebase. Moved it to server/platform/mysql.
• Updated Go to 1.25.6.
• Fixed an issue that allowed uploading invalid Android profiles.
• Fixed spacing and alignment for author on edit query and edit policy pages.
• Fixed an issue where VPP apps would fail with 9610 errors, by implementing a retry mechanism for VPP app installations.
• Fixed VPP versions refresh to update the latest version for all platforms of an Adam ID.
• Fixed a bug where failed software installs showed up in the host library page after transferring it to a team without that installer.
• Fixed fleetctl config get/set to show proper usage information when called without required arguments.
• Fixed cases where Fleet would show the wrong current VPP app version when app versions varied by platform.
• Fixed inconsistent styling for Controls > Setup experience > Bootstrap package.
• Fixed the metadata of the "Windows App" macOS installer, as it was reported as "Microsoft AutoUpdate" instead of "Windows App".
• Fixed an issue where newly-enrolled hosts would sometimes not be linked to SCIM user data.
• Fixed FMA create form to allow input fields to work properly as only edit was working correctly.
• Fixed Android certificate enrollment failures caused by SCEP challenge expiration when devices were offline.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.51.1
2. fleet-desktop-v1.51.1 (included with Orbit)
3. osquery-5.21.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

70d55a2cfdce369fbdd71fe10fba22165869ed58e01039dbf19e5fba5268ca77  fleet_v4.80.0_linux.tar.gz
74189fcff9d9c3f3e08f4e713da9301428fdfe63b3e31854d6b460c40db0afe8  fleetctl_v4.80.0_linux_amd64.tar.gz
eb5217f6bcec6da87ae1701ef76432ebeeeafd9539cbc4a70920b5bda287400b  fleetctl_v4.80.0_linux_amd64.zip
99e8c9860c81a70d97da09037a025da6c2f0b3c9a3f7fbe4855c91c7f06d9e0e  fleetctl_v4.80.0_linux_arm64.tar.gz
481a4b7d566334672ab9f5acf52b42ec8bc5a661de2aeabcdd273559ab16109b  fleetctl_v4.80.0_linux_arm64.zip
b399f8e1b915c0dd277c82eaf646662553a4f5b7b47210cf575a0a327fdec99f  fleetctl_v4.80.0_macos.tar.gz
ea61a54b77d2796c7dcd3de602906202b108b2c3be5cb6c50b1634c0da3ce29f  fleetctl_v4.80.0_macos.zip
1600fa5683ff09d0a569237eca574a03e3f364f9deee7afaecfa9c38a166f051  fleetctl_v4.80.0_windows_amd64.tar.gz
ed5521b3cd2350b43079165b29a664abb748af5aa363d5bbb22a4df3d29af062  fleetctl_v4.80.0_windows_amd64.zip
61266dd930c90346e89e6f0a0c5a8754a6c417c59ff2f0677c66f6071c5df5fb  fleetctl_v4.80.0_windows_arm64.tar.gz
26f6cf6755466ae28c27112baa7ddd508774c07a65d77c6f366f0b5ddcb83761  fleetctl_v4.80.0_windows_arm64.zip

Bug fixes

• Fixed bug in host activity card UI where activities related to MDM commands should be hidden when Apple MDM features are turned off in Fleet.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

df1e59a3298e366fcd34be47ab5d74f6b82f09dd8306566179a8d914c19b6d51  fleet_v4.79.1_linux.tar.gz
a241080eda4908ce4a154b7dbbfe53bccd1a81609b6b70c1ec10a4ad481c5b12  fleetctl_v4.79.1_linux_amd64.tar.gz
6d592817c41a8edb9febf29b1cf956ba1caedbb4038b76f3c1fb74a7c818d24f  fleetctl_v4.79.1_linux_amd64.zip
7b9ec8526305485fcf31d7339b692f3d53b679ed3587c46817297c358a01d2b5  fleetctl_v4.79.1_linux_arm64.tar.gz
be00160ea2e83ee5e69e3a253aa8d943cca27a7bbe1652bd42b6b78d776942ce  fleetctl_v4.79.1_linux_arm64.zip
1ed1997c60a0132afaeb98d2b48d074e8a76cfb01c3741c67a7272d0fc594157  fleetctl_v4.79.1_macos.tar.gz
7a0e281b52148daf745e163f443ba266a8d698210e76d2d0846b99631ee0d009  fleetctl_v4.79.1_macos.zip
3e1e25b292b8eea83ad036d684271d02796b8605a2fa20590001b82f22cdc5cf  fleetctl_v4.79.1_windows_amd64.tar.gz
4396621c553e4bca5d96a3074f0746fc858e5c4cd8ee7f83bd7e9307547d9c8c  fleetctl_v4.79.1_windows_amd64.zip
17d3ec54990712fea996b0de4215cfb155be8a67968b07907222f0f4af4cd7c6  fleetctl_v4.79.1_windows_arm64.tar.gz
7a8f9ca096e6c01363f4e377d403315be39f869ca8f2d713eeaf6613f5eac616  fleetctl_v4.79.1_windows_arm64.zip

Fleet 4.79.0 (Jan 14, 2025)

IT Admins

• Added ability to view past and upcoming MDM commands for a host in Fleet.
• Added ability to apply Android app configurations.
• Added support for resending Windows MDM profiles.
• Added support for renewal of custom SCEP profiles for Windows.
• Added support for team-specific labels. Currently team-specific labels must be created via spec endpoints, used by GitOps.
• Implemented ability to create, list, and delete Android certs from the UI.
• Added Android agent application (automatically deployed via Android MDM) to support automated installation of SCEP certificates on Android hosts.
• Added messaging around Apple VPP update failures due to the application being open.
• Added ability to indicate that new MacOS hosts enrolling via ADE should be updated to the latest operating system version.
• Added ability to edit Android software config in UI.

Security Engineers

• Added support for ingesting Windows certificates via osquery.
• Added activities for when certificates templates are created/deleted.

Other improvements and bug fixes

• Implemented streaming for the GET /hosts ("list hosts") API to improve performance.
• Updated API and GitOps to support AppleOSUpdateSettings.UpdateNewHosts.
• Added ability to search teams in dropdown when transferring teams.
• Added pagination metadata to the GET /mdm/commands endpoint.
• Updated the refresh_vpp_app_versions cron job to only attempt to refresh versions for Apple app store apps.
• Improved edit VPP UX by disabling a form that hasn't been edited.
• Updated logic used for determining whether to update a macOS host during DEP enrollment based solely on UpdateNewHosts flag.
• Added note to descriptions on schema tables using "count" as column name.
• Aligned Android MDM unenrollment endpoint with the already existing endpoint, DELETE /api/latest/fleet/hosts/{id}/mdm, for consistency across MDM platforms.
• Added migration for adding update_new_hosts flag to both App and Team configs.
• Changed the host details page to hide builtin labels in-line with other areas such as the label filter.
• Changed iOS/iPadOS and Android enrollment links on Add hosts modal to monospaced font to improve readability.
• Improved software upload progress modal.
• Improved consistency of gitops output language.
• Added loading state to turn off Android modal UI.
• Updated the migrate_to_per_host_policy cron job to no-op if Android MDM is not enabled.
• Updated software table so that all teams selection will now remove any unsupported url params.
• Improved unclear error message when uploading an APNS certificate if the CSR was not downloaded.
• Refactored RDS IAM authentication logic into a dedicated rdsauth package.
• Modified the automatic enrollment profile verification logic to only verify with Apple when a profile changes
• Updated S3 username/password when running in dev mode to remove outdated mentions of MinIO.
• Hid option to transfer hosts to their current team.
• Updated setup experience links to point to add software page relevant to platform.
• Revised auth requirements for /debug endpoints.
• Added additional validation to URL parameter for MS MDM auth endpoint.
• Improved SOAP message validation on Windows MDM endpoints.
• Fixed host query report to display "Report clipped" when a query has reached the 1k result limit.
• Fixed UI error message regarding adding software to a team with a duplicate title.
• Fixed an issue where batch uploading .mobileconfig profiles failed due to display name checks.
• Fixed an issue where certificate details modal overflowed the screen.
• Fixed click area of edit software file button.
• Fixed an issue where GitOps would fail if $FLEET_SECRET contained XML characters in XML files, due to not escaping the value.
• Fixed query behind fleetctl get mdm-commands to correctly get completed Windows MDM commands.
• Fixed MDM install command output to correctly display UTF-8 characters in the UI.
• Fixed missing upgrade code persistence when adding Windows software to Fleet via GitOps.
• Fixed duplicate entry error when updating upgrade_code during software ingestion
• Fixed case sensitivity mismatches causing duplicate titles during software ingestion
• Fixed a bug where iOS and iPadOS hosts enrolling via ABM MDM Migration did not have VPP apps installed.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.50.2
2. fleet-desktop-v1.50.2 (included with Orbit)
3. osquery-5.21.0 (included with Orbit)
4. fleetd-chrome-v1.3.3
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

532857020b0f1a46cdb5ad16f215d3b3264ebf0bb97754b302b6cce97255927a  fleet_v4.79.0_linux.tar.gz
51c169304d14383a38e74b81e19b34c562c91e14ef0f23037062a66721611415  fleetctl_v4.79.0_linux_amd64.tar.gz
ed128983f454c39cdb93b7e204c90fc9f172db81b8e98c9f754be9430a53b9a3  fleetctl_v4.79.0_linux_amd64.zip
d996e16bf6de750815a536a9c3e1bf0821bcc71e7d4a2fddaa705cdfa6558876  fleetctl_v4.79.0_linux_arm64.tar.gz
7fa1cbbb2234855321f840c41bd7935fe292615dde2c4af214f2e65ed3e9b56d  fleetctl_v4.79.0_linux_arm64.zip
3ccf4c1b47992574a88938bbb3064e729e93886c392af55a417fb57abfb22605  fleetctl_v4.79.0_macos.tar.gz
d03d43987893597d2c45bafa268bcfe7f89331f41ba93fec1415aa303f68a16e  fleetctl_v4.79.0_macos.zip
7438b13ae5be9ad38e647a7880ea74220a801e4573db99a41de3b17641cb3dae  fleetctl_v4.79.0_windows_amd64.tar.gz
99469dc84555612ebcc31e0a24ad806891f2a9d46fa96f6b1e7790297fa54858  fleetctl_v4.79.0_windows_amd64.zip
91ff4bc4936dabe7ee183d2fdc30b55cc3c2d8eefd3247ba52071039ecf038b2  fleetctl_v4.79.0_windows_arm64.tar.gz
af67a95a3195d4bcb8719612dc823705183736aa6d68b596d1c3dcf3bcb738ee  fleetctl_v4.79.0_windows_arm64.zip

Bug fixes

• Improved SOAP message validation on Windows MDM endpoints
• Revised auth requirements for /debug endpoints
• Added additional validation to URL parameter for MS MDM auth endpoint

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f4a2912237059bbb782f519442406ae49285d5888f1d2c6692307c22d707e405  fleet_v4.75.2_linux.tar.gz
fd01105903052a38c1c0542dd0837fab64beb81e20640bcc14611e310fca9403  fleetctl_v4.75.2_linux_amd64.tar.gz
3745b6e6894424cdd4ced29d4445fea94acbfb7bf9f6d6d26bb9628ee59f8b1f  fleetctl_v4.75.2_linux_amd64.zip
5cf86eb721cf5cb12f8552845fcd2f097f4182c42efbb7834c3c5edc013d661a  fleetctl_v4.75.2_linux_arm64.tar.gz
8817c72f016704fac43146fd0f50290cbeabddd5c31ead9087fb153c067cc20f  fleetctl_v4.75.2_linux_arm64.zip
31a3f5f057f075e499ddc86c32769a9f26c47a6fe197b4ad1752b374fdb7aeda  fleetctl_v4.75.2_macos.tar.gz
2134bf29f762368a5e2a8ccb2d28014834a1a5ccd451bd99dcf5eebc184a426d  fleetctl_v4.75.2_macos.zip
c86bb2efe8113201ede7b2ec9e727d8589f41fb23d1ca88d5733cd0dc6fae68e  fleetctl_v4.75.2_windows_amd64.tar.gz
f9678a604d419266b35d43378c9bff6d0c7767e6acdc74ebabd7857aa45b5956  fleetctl_v4.75.2_windows_amd64.zip
16cb60a38bd66be3fab396528aaed991a2528a4609b6f25bc5d8a453aab0e51c  fleetctl_v4.75.2_windows_arm64.tar.gz
7bf75c69cba73124966b374531af774cba4801b22aaa3b8f7c4a12dae7d95e9c  fleetctl_v4.75.2_windows_arm64.zip

Bug fixes

• Improved SOAP message validation on Windows MDM endpoints
• Revised auth requirements for /debug endpoints
• Added additional validation to URL parameter for MS MDM auth endpoint

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

788d533b7deb795848588b0e055b7308d84e32d2b87defd0cdcaab6f15e7b02d  fleet_v4.76.2_linux.tar.gz
b2a9de1b555cc94a32deed73897d8b473c394b3663569b94ed1b0809fe1ba8fb  fleetctl_v4.76.2_linux_amd64.tar.gz
6d9344d961c5b62687e96fd2b81cfcf87562559f0ea1ec02e72c9d4ee3f06a0f  fleetctl_v4.76.2_linux_amd64.zip
ce5fbea01eed04770b5f0cc82cfb980687373b1623c536644e2046ad16a2dd78  fleetctl_v4.76.2_linux_arm64.tar.gz
6412338e1308d4e709d931f67267186262566524a5b5a613a78797fceaf3803d  fleetctl_v4.76.2_linux_arm64.zip
8ec1815986dc497276c37230e6ce5277f77041430264d19886ce9cff31023e10  fleetctl_v4.76.2_macos.tar.gz
042b56ecb11910d235899a822b845f011b3c2604a447f0a1cfbb4c287e381ad5  fleetctl_v4.76.2_macos.zip
a80a816642677bb4c1dea430c65e28bbd0ab9b5c12ca665e5cb5c61d6820dc26  fleetctl_v4.76.2_windows_amd64.tar.gz
573e13aa6a9b6ec2fc74480b783995d2f5a4bffca2ad458928746b4284f856e4  fleetctl_v4.76.2_windows_amd64.zip
4914d26e0849376fb399fa0faaeab5fd29bd66ddef075aa6a7161afc8b191047  fleetctl_v4.76.2_windows_arm64.tar.gz
6f7d745e6e0b8b4815c92d6495db3807c7971c4fe2c98e5dd1f6d31286b9a300  fleetctl_v4.76.2_windows_arm64.zip

Bug fixes

• Improved SOAP message validation on Windows MDM endpoints
• Revised auth requirements for /debug endpoints
• Added additional validation to URL parameter for MS MDM auth endpoint

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

5a1539267421acac859875336d94152ab6c659649725ae495f1a5e0a97503bb9  fleet_v4.77.1_linux.tar.gz
b68c9d0436ca0128d92e9e6af5f5d83925ccc3cdeba78715b3151ac80684bfd1  fleetctl_v4.77.1_linux_amd64.tar.gz
7a1f5edb85750c2f581c1309dbede560bef65cf05820b0478e507431aabc109d  fleetctl_v4.77.1_linux_amd64.zip
4011bb883ff02d53ade40c95f7ad211a6166bf9c46e0dd9dabe583c2de2eb417  fleetctl_v4.77.1_linux_arm64.tar.gz
f63d340e4ce9e19d05168d4440d8860143cb5d98b0def14a9cf11fb79df4bbb8  fleetctl_v4.77.1_linux_arm64.zip
b6e1912fb1ee05008e2f2c06f3fdcb79f732340295410f6f07bdcd82bbc3f86a  fleetctl_v4.77.1_macos.tar.gz
9880678982cb091eaab6bb6a45f8d836d84ba54c45552a08b1b4c5686dea64a1  fleetctl_v4.77.1_macos.zip
c8fad858ed2ed2c2cbc9cf2b4c44aec4783d9344397b1ef1c5175ce97535ffca  fleetctl_v4.77.1_windows_amd64.tar.gz
89d39214202318cea6d84420532e450405d2a9a0257fbaa67d328a6a1e3fe92f  fleetctl_v4.77.1_windows_amd64.zip
2c490a5fa1c5f88146d629ec5fa3fc40370da28d364f5a5337999a001408e443  fleetctl_v4.77.1_windows_arm64.tar.gz
134ea899c02016ad8263ef9293f8bc6d2aa13e0f00c28fdd69ccec3af5618e2e  fleetctl_v4.77.1_windows_arm64.zip

Bug fixes

• Improved SOAP message validation on Windows MDM endpoints
• Revised auth requirements for /debug endpoints

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

c415edbbfed1899413a167b568a6d46b5c18b1dcfba3f01cc7f06dd11b843223  fleet_v4.78.3_linux.tar.gz
f60e70192d30521c2d0267b04582307870b076c9c5a143a8479228299f61fb4d  fleetctl_v4.78.3_linux_amd64.tar.gz
e12989fe35aa7a74aa170af1a1c724e40c443d994f4ea6e3e9678c7f0727796c  fleetctl_v4.78.3_linux_amd64.zip
ee90f4b54c4575a0b5bcf54220f042728cdbcbd98ea2816b24f4c220836e9b25  fleetctl_v4.78.3_linux_arm64.tar.gz
3afcee8aabecfe6d48f7ef7d55f9a5e09a6c994b8e15063da5e24343af257f64  fleetctl_v4.78.3_linux_arm64.zip
9b2b5cb49d7b3322604195ce2c2ddb8093095fbf4c046e646118ff2be2825c46  fleetctl_v4.78.3_macos.tar.gz
06cf74f32f954b4e92d08be52a41af58fce57d84870e76c7993fd05e7c371e94  fleetctl_v4.78.3_macos.zip
10dac64c64eda92350ea26aeacecefdd0705dd2273f5a73e5cfb7c172bd10be2  fleetctl_v4.78.3_windows_amd64.tar.gz
7d7f7a4092bd9c0b9448ed5df24e7e59849f66e77076509d5c6e2c2f270cd9be  fleetctl_v4.78.3_windows_amd64.zip
34401d28838941c83c1bb5a95a959ac0f0450d3f46f743f9c6c037f3e0054e17  fleetctl_v4.78.3_windows_arm64.tar.gz
6ea22ce52b5527b83d675409aa49468707897e58f5f965a704e3b4c5dc7ea8a2  fleetctl_v4.78.3_windows_arm64.zip

Bug fixes

• Added additional validation to URL parameter for MS MDM auth endpoint

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

3c0fb6373c6a87c7a8916c4f98066ea6843b02ad2586db9333ae990f63c6ae9e  fleet_v4.78.2_linux.tar.gz
5302b78e17a512fd44add3c9ba9e58f79f52d2e9dc526a2759720a5252e6ee11  fleetctl_v4.78.2_linux_amd64.tar.gz
2fdf8bf785cfa4f354d78feb081e7c904568113913c3cfc8c72dcc4246aff568  fleetctl_v4.78.2_linux_amd64.zip
302814ea80c1684fc0f5d54340bdf37a33e72bae21ee5a8c65e0c4a660ad32f1  fleetctl_v4.78.2_linux_arm64.tar.gz
e4efd7f8f64f71cdc4f0cec00d9ae6e1a9fe7e4356b27307726f061386525690  fleetctl_v4.78.2_linux_arm64.zip
4658b0d3ba46f4b390ed2d2f700e35ae71a6b9aacb47e7ec6f3d62a6366445d4  fleetctl_v4.78.2_macos.tar.gz
e41d2a963f9e9e9aab5a1e2008660c4ccc91d814b8fd7b99b2fcc3f738b275d3  fleetctl_v4.78.2_macos.zip
b89a98d079e077838b9e396e82841da2b0f3e0a9dc46814bd55ce2a3c8e47773  fleetctl_v4.78.2_windows_amd64.tar.gz
3ffd1c548bcca390a10f586afbd48632a318dee790aa05c0b7ac8b4b78ee12a8  fleetctl_v4.78.2_windows_amd64.zip
030fd16627f907a379ea69c05be8612e2fbe99a65a1438cc43a8642284419a7b  fleetctl_v4.78.2_windows_arm64.tar.gz
bfd111fa990523196afeea3a009f56a682b1f5ed41cfc3c8201c0566cc13739f  fleetctl_v4.78.2_windows_arm64.zip

Fleet 4.78.1 (Jan 6, 2026)

Bug fixes

• Fixed duplicate entry error when updating upgrade_code during software ingestion
• Fixed case sensitivity mismatches causing duplicate titles during software ingestion
• Added missing upgrade code persistence when adding Windows software to Fleet via GitOps
• Fixed a bug where iOS and iPadOS hosts enrolling via ABM MDM Migration would not have VPP apps installed

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

9f9f6423a4bccf267168b592f90ddd8d2819d3a13942975ed736174897b654dc  fleet_v4.78.1_linux.tar.gz
34cbe82900a2544b1500d8f3ffab6fe0d8aa1031a39afb97e5321841e1d3ac32  fleetctl_v4.78.1_linux_amd64.tar.gz
dd86cd7ab842df19374a061c25318a12c8ab578b49b7423e151c79d3ddcfc9d9  fleetctl_v4.78.1_linux_amd64.zip
23913c1d22c22aaf8a3c777a0a5eec94d4d58a45df9018d26fc63e445989d070  fleetctl_v4.78.1_linux_arm64.tar.gz
3f3a4a631a9b2ccdd4757e3658140c1b75bf02a06a7cef7847e9b139a282b795  fleetctl_v4.78.1_linux_arm64.zip
f63c6323ab579a2bba422f0922073da6eebe55f6fa21e23b0b34f970add44173  fleetctl_v4.78.1_macos.tar.gz
7f0acb9f330a94f830f7ddb8feda33e5d9f4105177db522c72be96881e92da50  fleetctl_v4.78.1_macos.zip
0cdf6372945a219b56c4854f11ba19b7526d06dd6a970e5ba593a2e8051c81ce  fleetctl_v4.78.1_windows_amd64.tar.gz
5f74bde28bc4c1891429cdc5e40a4b481c1a3f74dabb5591c49076abaf9088f9  fleetctl_v4.78.1_windows_amd64.zip
1e73c44d96d9856250215983957adf7275e820e7ae45d153b623f886b2d252b4  fleetctl_v4.78.1_windows_arm64.tar.gz
c758563ab07028deab7c00d9ff42b5220562bbbe1d0406f74478243a6bea867a  fleetctl_v4.78.1_windows_arm64.zip

Fleet 4.78.0 (Dec 19, 2025)

IT Admins

• Added support for Android setup experience software installation.
• Added support for Android self-service apps to fleetctl gitops.
• Added support for Android systemUpdate profiles.
• Added ability to create/view/delete Google Play Store software for Android in UI.
• Added $FLEET_VAR_HOST_PLATFORM for Apple platforms (macos, ios, ipados).
• Added support for installation of setup-experience VPP apps on manually-enrolled iOS/iPadOS devices.
• Added ability to deploy user-scoped SCEP profiles for Windows hosts.
• Added a configuration option to require Windows users turn on MDM manually via work or school account, rather than have enrollment happen automatically.
• Added UI to allow Windows hosts to manually enroll into Fleet MDM.
• Added support for $FLEET_VAR_HOST_HARDWARE_SERIAL and $FLEET_VAR_HOST_PLATFORM in Windows profiles.

Security Engineers

• Added ability to filter the activites on the dashboard page.
• Updated to regenerate FileVault profile when Apple MDM is turned on if the device's team has disk encryption enabled.
• Added Okta conditional access configuration to the Fleet UI under Settings -> Integrations -> Conditional access.
• Added endpoint for hosts to update certificate status.
• Added detail column to host_certificate_template table and added certificate_templates property with GitOps support.
• Updated fleetd/certificates/<id> and fleetd/certificates/<id>/status to authenticate using the orbit_node_key provided in the Authentication header.
• Updated MDM-enrolled Android devices to receive certificate templates in managedConfigurations.

Other improvements and bug fixes

• Improved performance by making the host_count property optional in the GET /labels API endpoints.
• Improved performance by avoiding unneeded extra queries when fetching team information.
• Improved request validation by returning an informative error when trying to filter software_titles with platform without a team_id.
• Allowed users to save Fleet queries even if their SQL is deemed invalid by the Fleet UI.
• Added a new error UI for file uploaders, and applied it in the Okta Conditional Access modal.
• Returned pre-install query output in Install Details modal.
• Translated idp to mdm_idp_accounts on API responses.
• Updated last_restarted_at property for hosts to be more reliable.
• Added Mosyle to the list of well-known MDM platforms.
• Changed where mdm_enrolled activity is created so it occures after the inital Token Update command to allowa the webhook to fire after the host can recieve additonal commands from Fleet MDM.
• Improved MDM command result endpoint response for pending Windows commands.
• Switched configurations referencing Redis 5 to Redis 6. Fleet is no longer verified to work with Redis 5 or below.
• Redacted API tokens in fleetctl config set to prevent accidental logging.
• Updated error message when attempting to run software install script on host with scripts disabled to refer to --enable-scripts flag (instead of --scripts-enabled).
• Updated queries APIs that drive the OS Settings UI to include the status of host cert templates.
• Updated the layout and styling of file uploader buttons across the UI.
• Updated built-in SVG icons to avoid rendering issues when certain combinations of icons are on the same page.
• Added consistant spacing to UI elements on the MDM page.
• Updated Go to 1.25.5.
• Fixed an issue where using bitwise operators in a query incorrectly marked the query as invalid.
• Fixed issue where MDM profile retry limits were interfering with Smallstep SCEP proxy renewal attempts, particularly in cases of expired SCEP challenges.
• Fixed incorrect status code on failure to interpolate certificate template variables.
• Fixed Android configuration profiles downloading as unusable .xml files with content [object Object]. Android profiles now download correctly as .json files with properly formatted JSON content, matching what was originally uploaded.
• Fixed the tab order of elements in the login form.
• Fixed UI bug where the option to resend MDM profiles for macOS hosts was incorrectly presented to non-admin and non-maintainer users.
• Fixed an issue that prevented GitOps from saving multiple queries with the same label.
• Fixed an issue where "Exclude Any" label scoping did work properly for iOS, iPadOS and Android hosts.
• Fixed bug that prevented filtering by platform when listing hosts with failed profiles.
• Fixed software action buttons to disable immediately on click to prevent multiple clicks.
• Fixed an issue where newly-enrolled Windows or Linux hosts were not automatically linked with existing SCIM user account data.
• Fixed UI bug in OS settings modal that caused status tooltip to flicker when refetching host details.
• Fixed a race condition when resending Apple Profiles that would not truly resend the latest profile.
• Fixed a missing redirect to the Fleet website.
• Fixed the connect message on the controls end user auth page so that it is consistant with the other set up experience subsections.
• Fixed a bug where "installed" software sometimes showed up as "uninstalled" when certain other pieces of data were not also present.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.50.2
2. fleet-desktop-v1.50.2 (included with Orbit)
3. osquery-5.21.0 (included with Orbit)
4. fleetd-chrome-v1.3.3

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

a75667c3362b5ffa11d1c95e2839aeb4fe74cd274994aee08148fd6179527c74  fleet_v4.78.0_linux.tar.gz
5753557878a06de58c7aabdc2d55f27792ccacaed43ff9cc41ed9ef9f52bd943  fleetctl_v4.78.0_linux_amd64.tar.gz
ed9bf44b737e2285066ccf0c0f0fa328b7d6ec0033edb119183e4ded5d20f2c2  fleetctl_v4.78.0_linux_amd64.zip
1ba0a5d96566efed20a1ce96d3303e42ff2a0b7b8d3527bb35066efdb23ca5a0  fleetctl_v4.78.0_linux_arm64.tar.gz
cfd528a01f463a6b5afcc696fbaffc896b4f4a4e8a8dde6034eff9fa1082f582  fleetctl_v4.78.0_linux_arm64.zip
c6b2ad11c958f38b53168ee9396f6bded3ed5f863c253ade07eaf00921672488  fleetctl_v4.78.0_macos.tar.gz
e721bd5cf7c2fc378dc968cb24d229590bfd376226d50387d2ad1db42c17cb50  fleetctl_v4.78.0_macos.zip
a188080d9c972dc883e1a268a4d040dadf7912901a7a91c25c9e4f640396054b  fleetctl_v4.78.0_windows_amd64.tar.gz
8c41eafab9cb38e4a97b464f86e926da12c7b0531f848a3c306dc04ecfd7960c  fleetctl_v4.78.0_windows_amd64.zip
87e80393f956b137571cf6bce870c3eb0256c155d0ea76cef69fba1d6b5ca49c  fleetctl_v4.78.0_windows_arm64.tar.gz
e3aeddceada71115e53d86f74b8300566660cb44e2229c4cbd4f97d96ee668e7  fleetctl_v4.78.0_windows_arm64.zip

Fleet 4.77.0 (Dec 02, 2025)

Security Engineers

• Added activity log entries for: host deletion and expiration, updating or deleting host IdP mappings.
• Resolved multiple false positive vulnerability matches for the VSCode golang extension.
• Resolved false positive CVE matches for Logi Bolt.app.
• Detected vulnerabilities in JetBrains IDE plugins.

IT Admins

• Updated MDM enrollment flow for BYOD macOS hosts to enable end user authentication prior to downloading the MDM profile via the "My device" page.
• Added self-service install support for custom IPA apps on iOS and iPadOS.
• Added support for in-house (".ipa") apps to fleetctl gitops.
• Updated existing POST /setup_experience/script endpoint to allow updating the macOS setup experience script in-place, and modified GitOps to remove the DELETE call.
• Added support for Custom EST certificate authorities.
• Added ability to deploy certificates from Custom SCEP certificate authorities on Windows.
• Added status counts to batch script detail page tabs.
• Added InstallAnywhere as a self-extracting archive for PE metadata extraction.
• Added ingestion of upgrade_codes from Windows software, and provided to all relevant software endpoints.

Other improvements and bug fixes

• Improved performance of /api/latest/fleet/software/versions API endpoint.
• Updated host expiry logic to not delete macOS hosts that checkin via MDM protocol but not via fleetd.
• Optimized the cleanup Apple host profiles query to reduce probability of DB locking.
• Implemented UI logic to call existing manual update IdP API functionality.
• Implemented UI logic and new DELETE endpoint to manually remove host IdP mappings.
• Added experimental FLEET_MDM_ENABLE_CUSTOM_OS_UPDATES_AND_FILEVAULT configuration to allow deploying custom OS settings including Filevault payloads and macOS and Windows update settings.
• Added ability to change software display names in the UI.
• Fixed table styling for selecting table rows.
• Simplified setup experience configuration UI.
• Added better error messages when using build-in labels on GitOps and on the LabelSpecs endpoint.
• Hid software host count and version table when no hosts have the software installed.
• Adjusted UI section headers and layout of Settings > Integrations in Fleet Free.
• Added vulnerability seeding and performance testing tools.
• Moved end user authentication SSO settings under Integrations > SSO in global settings.
• Removed the premium check for host OS settings in host summary UI.
• Reduced Android device reconciler frequency to 1 hour.
• Reduced Android API usage by listing devices instead of getting and checking Android Enterprise disconnects hourly.
• Set the order of software installed during the setup experience to alphanumeric.
• Updated Go to 1.25.3.
• Fixed a layout issue on the script batch details page.
• Fixed installer for Cisco Secure Client not showing as installed in inventory/library due to using the wrong bundle identifier. This application should show up correctly now in the software inventory.
• Fixed errors when trying to run the apple_mdm_iphone_ipad_refetcher cron job.
• Fixed bug that prevented users from editing custom EST certificates URLs.
• Fixed incorrect UI placeholder element by replacing it with it's actual value.
• Fixed issue where vulnerabilities would occasionally show as missing.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.50.1
2. fleet-desktop-v1.50.1 (included with Orbit)
3. osquery-5.20.0 (included with Orbit)
4. fleetd-chrome-v1.3.3

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

014f227e5e473510a215d64c7d589eca436a7ae8dd4418af30d50b2f36cbb4ff  fleet_v4.77.0_linux.tar.gz
694ba395c6274c36876a364a1c0c48cbcfa29e0fbe48cd5bdb4b249281657ba8  fleetctl_v4.77.0_linux_amd64.tar.gz
b9c7f4fab027228d1d9ee03d3d91e4f0d21ddcd2d66ca5260b237861285f50a1  fleetctl_v4.77.0_linux_amd64.zip
7f1abd61ec0e113c8f2c1344901a4fc93620da86bcef90b546f82498fe512758  fleetctl_v4.77.0_linux_arm64.tar.gz
8376763b99fa04f89fa4cfd4fdcafd1e3e0d50b7706f70ce12f0e8ef6886bfc8  fleetctl_v4.77.0_linux_arm64.zip
cac4ae3ccb3816d1ef8cd29b347d39126a3c33fc178393fac936ba3489fe4a06  fleetctl_v4.77.0_macos.tar.gz
b641a3e666150e4eeec6cca8e3e4bbf37a0c69605ad54cc0b997c47df684fb48  fleetctl_v4.77.0_macos.zip
e53f1d9ea91c31661bd6e5521911553beaf1af48163d6887f5075f82460a1ddb  fleetctl_v4.77.0_windows_amd64.tar.gz
6dcfca6971b22bd842e30e5f24051fe97f81432bc3d7be81c034fbb98e491004  fleetctl_v4.77.0_windows_amd64.zip
f9cf1cfcf510ca724c55778edad5dff585073aa94797c4fc9e9cc44693cda071  fleetctl_v4.77.0_windows_arm64.tar.gz
9b11e38a413c6f73cdfe680e024a0874e62c249fa2696129f3bb0dcd13e81efe  fleetctl_v4.77.0_windows_arm64.zip

Bug fixes

• Updated existing /setup_experience/script POST endpoint to allow updating the macOS setup experience script in-place, and modified gitops to remove the DELETE call

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

39c17ecb56815ecef51cb91fae7228bf13b67a8be1e8cb101f863276ef263e82  fleet_v4.76.1_linux.tar.gz
af2b6a9813222a215b5756f7593fdcc666e5cda9212e16612b7583cb6bcd067d  fleetctl_v4.76.1_linux_amd64.tar.gz
48bb1af1b6256214400db94ea7c0263207b8a43a32aaa255ab4cd2a7b2662a4a  fleetctl_v4.76.1_linux_amd64.zip
4f2adb5fb1262cfce62f185fa0e9d0934730e46dd1a66fe73d7824b44c8fe86c  fleetctl_v4.76.1_linux_arm64.tar.gz
cc0f256a095064fd83ea244a676cecbadfd4572883802a347cf643d07cfb4ce0  fleetctl_v4.76.1_linux_arm64.zip
40226d6081351c2042e641471aa21064d368bff30a47ff11c2dbcef54b131d83  fleetctl_v4.76.1_macos.tar.gz
ae1eb85029e3ea9abea1cd3e4a8aa8c1680862b13cd9a03a4bb653747c219554  fleetctl_v4.76.1_macos.zip
bd39ce43c6d408e3448f21043f7b95f9618218ff4d7b0100be7143f8c1d9cd18  fleetctl_v4.76.1_windows_amd64.tar.gz
95a1781fd00fa9e4202c8c4bbc8ec9f6e74715b440c06159b407a8f8aaba52f4  fleetctl_v4.76.1_windows_amd64.zip
af958f7bad34d11ecc2be44b2d1860dc2b90c9d2743642609ae56ed46026e294  fleetctl_v4.76.1_windows_arm64.tar.gz
d4584c2524488468f45c14db870a1afa3d9ed2b8010b0d584b775338ad52d13e  fleetctl_v4.76.1_windows_arm64.zip

Fleet 4.76.0 (Nov 7, 2025)

Security Engineers

• Added support for software inventory on Android hosts.
• Added support for npm packages in software inventory and vulnerability matching for macOS and Linux hosts.
• Added support for JetBrains inventory on hosts.
• Added vulnerbaility detection in JetBrains plugins.
• Added support for VSCode fork (Cursor, Windsurf, VSCodium, VSCodium Insiders, and Trae) extensions in software inventory.
• Added Santa tables to fleetd.

IT Admins

• Added ability to install software for iOS and iPadOS hosts during the setup experience.
• Added ability to specify VPP apps for automatic installation during ADE iOS and iPadOS host enrollment.
• Added the ability to lock iOS and iPadOS devices through lost mode.
• Added support for locking and unlocking iOS and iPadOS devices from the UI.
• Added configuration option to setup experience for macOS hosts to halt if any software install fails.
• Added gigs_all_disk_space vital collection, storage, service, and UI rendering for Linux hosts.
• Added new server config flag for specifying the cleanup age for completed distributed targets.

Other improvements and bug fixes

• Added link component shown in the host column to the host details page.
• Added flash warning when an unauthorized user tries to access teams settings.
• Added descriptive error in cases of manual macOS profile download failure.
• Updated the macOS setup experience to use the new web UI.
• Updated the UI for adding new scripts to the scripts library.
• Changed display logic for the organization logo component on the My Device page to prevent flickering.
• Improved performance of /api/latest/fleet/os_versions endpoint, especially for deployments with Linux hosts.
• Optimized MySQL queries on /api/latest/fleet/vulnerabilities and /api/latest/fleet/software/versions to improve performance for Fleet UI use cases.
• Optimized /config API endpoint to use the primary DB node for both persisting changes and fetching modified app config.
• Improved live query response times by adding a new server config flag for specifying the cleanup age for completed distributed targets.
• Improved query performance by using a lighter-weight query for checking if a team is enabled for conditional access.
• Changed license warning to only show one time during GitOps runs.
• Updated to allow setting an org support url to use the "file" protocol in the url.
• Changed the default name of Host Identity CA to 'Fleet Host Identity CA' to avoid conflict with Fleet's Apple MDM CA.
• Updated host details run script user flows to include a confirmation step.
• Applied singular word form to GitOps log messages when a single entity is referenced in the message.
• Updated the "Setting up your device" page to show status of setup script run.
• Deprecate browser in favor of extension_for in API responses and JSON/YAML outputs.
• Added migration to clear the platform field on all builtin labels.
• Added migration to relink missing SCIM user data to hosts.
• Updated host certificate renewal flow for NDES, Smallstep, custom scep proxy CAs to support $FLEET_VAR_SCEP_RENEWAL_ID in the OU field rather than CN.
• Updated device mapping API to allow an "idp" source to manually set IDP user mappings.
• Updated styling to be more consistent in edit policies view for FireFox.
• Replaced outdated Firefox icon with a new one that follows brand guidelines.
• Allowed testing a new or edited policy query via live query while in GitOps Mode.
• Fixed missing "failed" VPP app install activities when installation is canceled due to MDM being turned off for a host.
• Fixed bug where uploading a software installer failed because it was "not found in the datastore".
• Fixed missing aboslute timestamp tooltips on script creation date in script list, query modification date in query list.
• Fixed bug with the ChangeManagement component where the GitOps checkbox local UI state was being reset due to GET request after PATCH request.
• Fixed MySQL deadlocks when multiple hosts are updating their certificates in host vitals at the same time.
• Fixed an issue where longer variable names ($FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART) with the same base ($FLEET_VAR_HOST_END_USER_IDP_USERNAME) was not processed in the right order.
• Fixed UI bug where "Show disk encryption key" option was incorrectly displayed for hosts enrolled with a third-party MDM solution.
• Fixed WhatsApp and VS Code icons not displaying correctly
• Fixed bad software ingestion debug message and added filter for invalid software with missing names.
• Fixed a bug where a software installer could be installed in the same team and same platform (macOS) where an App Store app already existed for the same software title, and vice-versa (App Store app added when a sofware package already existed, this one was only possible just via fleetctl gitops).
• Fixed listing hosts with populate_software not returning hash_sha256 for macos apps.
• Fixed bug where batch setting MDM profiles could cause a nil pointer dereference when processing an invalid profile (e.g., cannot parse mobileconfig because it is bad xml).
• Fixed bug hiding the UI elements post install script output in Software Install Details modal.
• Fixed software title host count mismatch that was caused by including software installers in the count.
• Fixed a scenario where a wiped Windows host re-enrolled as a distinct host row in Fleet and the previous host's page could not be loaded successfully.
• Fixed an issue where a host transfer on mdm_enrolled activity would be reversed by orbit enroll.
• Fixed a bug in live queries that caused livequery:{$CAMPAIGN_ID} Redis keys to not be cleaned up or expire.
• Fixed inconsistency in GitOps for App store apps if no VPP token was found, so that both dry run and actual run fails.
• Fixed the software title counts by status to be consistent with the status reported in the host's software list and filter by status.
• Fixed outdated tooltip on dark background logo URL field in Organization info settings.
• Fixed fleetctl generate-gitops when MDM is not turned on.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.48.1
2. fleet-desktop-v1.49.1 (included with Orbit)
3. osquery-5.20.0 (included with Orbit)
4. fleetd-chrome-v1.3.3

While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

0fbb04d29e075b25a80d1c5acfdf60e9bfb38289cdf123a8f72b78dfe3bd805f  fleet_v4.76.0_linux.tar.gz
9d3eadeae6d3f1a2fbe65032c2a667945040d8a5db17f664c7532f5109701dd0  fleetctl_v4.76.0_linux_amd64.tar.gz
fa78a4fdddef9bf9ebb7eaeba43b719c24dc1629a30e46feed57855a4ad9d3ab  fleetctl_v4.76.0_linux_amd64.zip
7f030c055185d50d47852f152f8ec8bfc86bf883435a4b4ca6317a50b7e849b6  fleetctl_v4.76.0_linux_arm64.tar.gz
3d59a661cf054db548f0aca6da4ab68fa8d94e11ae749fd0e8896a09dac8aec9  fleetctl_v4.76.0_linux_arm64.zip
2e3a52d862238877e190733e597eadb801f6ef63cf32c0247b2f3237ea2f9c11  fleetctl_v4.76.0_macos.tar.gz
5a8f36ed77cf1d80cce10cca2ac66c4cb04c1deb32d9364512de2cf1d3c7bd01  fleetctl_v4.76.0_macos.zip
849e04c80a830095739a84541525d7d79ff4e2485c98d7765f987f5fd12db546  fleetctl_v4.76.0_windows_amd64.tar.gz
584d9a2d476182d2307c275070257e80ab903d1eb51f329bfef88d0a647eaefc  fleetctl_v4.76.0_windows_amd64.zip
8aacc129b1483b044ea576e3efd3b9d418a7634edb16623349a784f7ff9c7582  fleetctl_v4.76.0_windows_arm64.tar.gz
1bf46c17000a3e83e2ae68b368d78b32e1ddf9dee9d9ed333534ef9eec818f0c  fleetctl_v4.76.0_windows_arm64.zip

Bug fixes

• Fixed fleetctl generate-gitops when MDM is not turned on.
• Reduced load on migration from 4.74.0 and below.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

579c79becb7bea7812185150fd0706e161b3f4753f81302d920aba9bfc2bf3a4  fleet_v4.75.1_linux.tar.gz
77afc5ca0f1051f41b787c52ffd401fbe1eaefc4a7d1859732f87f8491828b99  fleetctl_v4.75.1_linux_amd64.tar.gz
c170ac336de734ddd86d3039761bf58be3261ff34685a1df2539d9661113e713  fleetctl_v4.75.1_linux_amd64.zip
91a2d95d08a52327882385883c43ad51b7a580c49f8db3ee887808c9d3222e72  fleetctl_v4.75.1_linux_arm64.tar.gz
a8a628d01e789611452ef3ce715eb7fc7f5e1bac5658a2c4965ab7b9a059b7d4  fleetctl_v4.75.1_linux_arm64.zip
b7571b281fdb8ea4e419248c3cff4f5df772133527e3c2645f46c42a6eb0f5ac  fleetctl_v4.75.1_macos.tar.gz
149dfe86fcf295e66e05e53f511988f859452e9f167f5dcfa0389f7f29bc1c36  fleetctl_v4.75.1_macos.zip
aca922953dda7f9760df7d2f3fd707e6f0edb9b92c18f037adb4a06a66d6e7aa  fleetctl_v4.75.1_windows_amd64.tar.gz
9465a688d4ded8193490edd889f9859cefae3550eea5ab783558db370f5b3ed8  fleetctl_v4.75.1_windows_amd64.zip
1bc35a50adba0336d86a6dcb7d21a9226d1fae0422b6993f465ed90249e2819e  fleetctl_v4.75.1_windows_arm64.tar.gz
4d6c09b7afa67ba3a129a2e9eeb9d8b45aa75c43cb70e4939c63f4570204ebf2  fleetctl_v4.75.1_windows_arm64.zip

NOTE: Fleet added Santa tables: santa_allowed, santa_denied, santa_status. If you already deploy a custom Santa extension (like Trail of Bits) with tables that have the same names (exactly), Fleet's agent will crash. To resolve, update variables in this script and run it on macOS hosts to uninstall your custom Santa extension.

Fleet 4.75.0 (Oct 17, 2025)

Security Engineers

• Added support for Smallstep certificate authority.
• Added false-positive filtering for Linux vulnerability scanning.
• Added support for Arch Linux hosts.
• Added software inventory ingestion from Arch Linux hosts.
• Added new rate limiting implementation for Fleet Desktop API endpoints to support all/many hosts of a deployment behind NAT (single IP).
• Added support for reading server private_key from AWS Secrets Manager.
• Added support for vulnerabilities feed CPE translation JSON to override sw_edition field.
• Added filter for removing duplicate RPM python packages and renaming pip packages to match OVAL definitions (same as Ubuntu).
• Added ability to specify a Fleet host ID when declaring a manual label in a Gitops YAML file.
• Added a dedicated page, table, and logical integrations with other parts of the UI for managing labels.

IT Admins

• Added configuration profile support for Android hosts.
• Added activity logging for Android profile creation, modification, and deletion.
• Added support for software installation during Windows setup experience.
• Added support for Arch Linux hosts.
• Added software inventory ingestion from Arch Linux hosts.
• Added support to fleetctl to generate fleetd installers for Arch Linux (.pkg.tar.zst).
• Added software name into checksum calculation for macOS apps.
• Added ability to specify a Fleet host ID when declaring a manual label in a Gitops YAML file.
• Added a dedicated page, table, and logical integrations with other parts of the UI for managing labels.
• Added OpenTelemetry instrumentation to scheduled jobs and several API endpoints.
• Added CRON job to reconcile Android profiles.
• Added retries with backoff when Apple's assets API fails with a timeout error.
• Added ability to unenroll personal iOS/iPadOS devices from Fleet.
• Added support for assigning host labels based on idP attributes for iOS and iPadOS hosts.
• Added ability to turn off MDM for iOS and iPadOS devices when refetcher returns device token is inactive.

  Note: The package will need to be updated out-of-band once, because the pre-removal script from previously-generated packages is called upon an upgrade. The old pre-removal script stopped Orbit unconditionally.

• Added support for hosts enrolled with Company Portal using the legacy SSO extension (for Entra's conditional access).

Other improvements and bug fixes

• Updated DEB and RPM packages generated by fleetctl package to now be safe to upgrade in-band through the Software page.
• Updated to return count in list host certificates API response, and use it in the certificate table.
• Updated setup experience to try software installs up to 3 times by default in case of intermittent failures.
• Modified the Apple profile reconciliation CRON logic to query for installs and removals within a transaction to avoid race conditions around team or label changes.
• Fixed inconsistent spacing in Controls OS settings headers.
• Validated setting manual_agent_install option on the server.
• Ignore warning when LastOpenedAt for software is nil on macOS.
• Improved install action tooltips and modals including timestamps to VPP successful installs.
• Changed the response code for UserAuthenticate checkin messages, which are unsupported, from a 5XX to "410 Gone" as specified in the Apple MDM protocol docs for servers that do not implement this method.
• Ensured UI consistency by adding a border to the empty state of End User Authentication section.
• Added easy to understand error messages when configuring Entra conditional access in Fleet.
• Updated docs for the pwd_policy table to better reflect the meaning of days_to_expiration.
• Improved the layout of the IdP-driven label form.
• Updated Hosts table > hostname column to truncate overflowing hostnames and place the full name in a tooltip on hover.
• Removed duplicate tar.gz copies of osqueryd and Fleet Desktop from built packages (DEB/RPM/PKG).
• Extended the number of errors Fleet looks for when determining whether we should invalidate the prepared statements cache.
• Updated instructions in Linux key escrow modal.
• Adjusted log level to "info" instead of "error" when Windows MDM endpoints generate client errors (e.g. empty binary security token).
• Disabled debug logging by default in fleetctl preview and reformatted login information.
• Improved handling of host details page label pills for labels with very long names.
• Modified Controls > OS settings > Custom settings so profile upload time is based on updated_at instead of created_at.
• Added check to GitOps command to throw error if positional arguments are detected.
• Added an error message when software is defined in a package YAML file in GitOps but some fields expected in that file were set at the team level. Previously, GitOps would silently ignore the fields set at the team level in this case.
• Updated the OS updates current versions empty state to match consistancy with other empty states.
• Updated message shown in the 'Delete Script' modal.
• Added a delay to the platform compatibility tooltip showing when creating or editing a query.
• Added error when uploading signed profiles instead of when trying to deliver them.
• Updated old end user migration workflow preview, and switch to video for product consistency.
• Replaced outdated Firefox icon with a new one that follows brand guidelines.
• Updated UI to make policy pass/fail icons and copy consistent across host details, my device, and manage policies tables.
• Removed the software renaming fix introduced in 4.73.3 due to MySQL DB performance issues.
• Optimized software ingestione rename functionality to generate less lock contention during high concurrency.
• Optimized ingestion of software names on macOS apps when vendor-supplied bundle executable names are unclear.
• Optimized software title reconciliation in vulnerabilities cron job.
• Revised macOS software ingestion to correctly show application names for Steam games instead of run.sh.
• Added logic to detect and fix migration issues caused by improperly published Fleet v4.73.2 Linux binary.
• Updated go to 1.25.1.
• Fixed inconsistent subtitle text style in Custom Settings.
• Fixed SentinelOne pkg generating wrong bundle identifier for auto-install policy.
• Fixed required query parameters using field name instead of parameter name in error messages
• Fixed a bug where blocking of VPP installs on personally enrolled Apple devices was not in place.
• Fixed edit teams action in VPP table dropdown not being blocked when Fleet is in GitOps mode.
• Fixed certificate ingest parser to no longer break on multiple equal signs in certificate key pair values.
• Fixed certificate ingest parser to allow for only multiple relative distinguished names separated by +.
• Fixed 422 error when hitting /api/v1/fleet/commands endpoint with team filter.
• Fixed deletion of conditional access integration by adding a spinner and clearing the tenant ID after the deletion.
• Fixed an issue on ChromeOS and Windows where the cursor in the SQL editor is misaligned.
• Fixed issue where "Controls" link in the top nav didn't always go to the default controls page.
• Fixed cases where Firefox ESR installations would have false-positive vulnerabilities reported that were backported to the ESR.
• Fixed clicking the currently selected navbar item would cause a full-page rerender.
• Fixed EULA path to be relative to the YAML file in fleetctl gitops, as it is for other settings.
• Fixed bundle identifier for privileges macos software pkg and fixed existing software installers to use corrected software title. The privileges application should show the correct status in software inventory.
• Fixed the reported version of fleetd on the Software tab for Linux hosts.
• Fixed invalid GET and DELETE requests that incorrectly included request bodies in client code, ensuring HTTP compliance.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.48.1
2. fleet-desktop-v1.48.1 (included with Orbit)
3. osquery-5.19.0 (included with Orbit)
4. fleetd-chrome-v1.3.3

While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f37a55734f73bc4930afb8dc4999655de56496f090a2f22bb60271b1fc748203  fleet_v4.75.0_linux.tar.gz
471c043b64479b986329d7b7ca29887bebc5c62349ad8b0878ed77c1250c32b6  fleetctl_v4.75.0_linux_amd64.tar.gz
fcb00a0a26053a6398a26d3ea73efd956a291505d1542b151d29e5d69fbbb802  fleetctl_v4.75.0_linux_amd64.zip
75becdcd6a98ddcdb7d82d92b2f32c7da441030a1e32648b58713737e22ac126  fleetctl_v4.75.0_linux_arm64.tar.gz
fb946d4c699f9aa7b092b6d5223c319c7cbf64694f7434a527405e51663561c5  fleetctl_v4.75.0_linux_arm64.zip
54811cf543aa1a365f2b29287fff2d011898a9714525dda1428f38406e8b72c3  fleetctl_v4.75.0_macos.tar.gz
a399ec13991b4d471716eac3e3a09e75807dfd56137d4bf3181bb2cd7f229aeb  fleetctl_v4.75.0_macos.zip
88f4e9dbb966560faeb94ff4ce26ecc95a7a8ee98d621b033949e412dbd09977  fleetctl_v4.75.0_windows_amd64.tar.gz
65b69da9a220277566e92a42725fd6698d8c90a324200bd6c9d8a5562f576952  fleetctl_v4.75.0_windows_amd64.zip
e542ac7ce32c4a87ccc610aa8be4d12eb51aa2daca1726f6b40dc2eece81ed9e  fleetctl_v4.75.0_windows_arm64.tar.gz
7759a409f7089f1c86d5a229437cae28c60e70b8cbc6fd149f8e5739e461f477  fleetctl_v4.75.0_windows_arm64.zip

Bug fixes

• Fixed edge case when renaming macOS software mapped to multiple checksums.
• During software ingestion, re-added software rename functionality to generate less lock contention during high concurrency.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

94bd10f26d06c613829af110870286b9ef5c16c85356506872b3816fe973a8a4  fleet_v4.73.5_linux.tar.gz
274f6562a1e5c4ae4af745ce64ba9ddc7554bf98f4ca225ad1cd86f91677e0f1  fleetctl_v4.73.5_linux_amd64.tar.gz
169ffe91fb732fe10bb1bd8ddc41c59dd11175a46fd78927f277af50c32398d5  fleetctl_v4.73.5_linux_amd64.zip
a4c1095e4ebe62ff71069370e7c9b2d94063835c98d3568d69829df8d7d0e5e9  fleetctl_v4.73.5_linux_arm64.tar.gz
7e7a0acc8319dc89e8d942ff7fb9460918f328f5330902c4660cb0b920da805a  fleetctl_v4.73.5_linux_arm64.zip
5077d23f8e4bd3b130a7663e1c01b59ad39ca33d9f7500f74d9f85122215e160  fleetctl_v4.73.5_macos.tar.gz
902f092c2eb6d39d783202c75cc5cb2f6c0ef864cbfb8933bbaeebc5ac3fb054  fleetctl_v4.73.5_macos.zip
d3e95ecced5397d76ec1216ef063e15aa289ee9d774d02a1c024fb342f50b5d0  fleetctl_v4.73.5_windows_amd64.tar.gz
d45ab01e25caf87a68bafff69b15b957231538622e6aaf23cf4b93b4cb8982db  fleetctl_v4.73.5_windows_amd64.zip
d7ec75594a0abfc4db039ca92a0a44d45e1bd3413a758e99da5557e2b86ef2b4  fleetctl_v4.73.5_windows_arm64.tar.gz
5c3a79b40745aa9d93d2adea4f76bf9a906bff1775150b89005ee04afcfaeaf8  fleetctl_v4.73.5_windows_arm64.zip

Fleet 4.74.0 (Oct 6, 2025)

This release includes breaking changes in the software YAML. For migration instructions and more information, please see this public document.

Security Engineers

• Added support for Hydrant as a Certificate Authority and added an experimental API that can be used to have Fleet request a certificate from a Hydrant.
• Added a check to disallow FLEET_SECRET variables in Apple configuration profile <PayloadDisplayName> fields for security.
• Added /batch/{batch_execution_id:[a-zA-Z0-9-]+}/host-results API endpoint to list hosts targeted in batch.
• Added POST /api/v1/fleet/configuration_profiles/batch API endpoint to batch modify MDM configuration profiles.
• Added a new page in the UI for batch script run details.
• Added support for AWS RDS (MySQL) IAM authentication.
• Added support for AWS ElastiCache (Redis) IAM authentication.
• Added support for hosts enrolled with Company Portal using the legacy SSO extension for Entra's conditional access.

IT Admins

• Added setup experience software items for Linux devices.
• Added ability to upload custom software icons.
• Added API endpoints for Linux setup experience.
  • Device API endpoints for fleetd: POST /api/fleet/orbit/setup_experience/init and POST /api/v1/fleet/device/{token}/setup_experience/status.
  • PUT /api/v1/fleet/setup_experience/software and GET /api/v1/fleet/setup_experience/software now have a platform argument (linux or macos, defaults to macos).
• Added IdP fullname attribute as a valid Fleet variable for Apple configuration profiles.
• Added the username of the managed user account user-scoped profiles are delivered to for macOS hosts.
• Enabled configuring webhook and ticket policy (Jira/Zendesk) automations for "No team".
• Added support for writing multiple packages in a single GitOps YAML file included under software.packages.
• Moved self_service, labels_include_any, labels_exclude_any, categories, and setup_experience declarations to team level for software in GitOps; setup_experience can now be set on a software package, Fleet Maintained App, or App Store app.
• Changed GET /host/:id to return an empty array for software field when exclude_software=true.
• Updated generate-gitops command to output filenames with emojis and other special characters where applicable.
• Added a Fleet-maintained app for macOS: Omnissa Horizon Client.
• Added opening instructions to self-service macOS apps and Windows programs.

Other improvements and bug fixes

• Added index to distributed_query_campaign_targets table to speed up DB performance for live queries.

WARNING: For deployments with millions of rows in distributed_query_campaign_targets, the database migration to add the index may take significant time. We recommend testing migration duration in a staging environment first. The initial cleanup of old campaign targets will occur progressively over multiple hours to avoid database overload.

• Added clean up of live query campaign targets 24 hours after campaign completion. This keeps the DB size in check for performance of large and frequent live query campaigns.
• Improved OpenTelemetry integration to add tracing to async tasks (host seen, labels, policies, query stats) and improve HTTP span naming, enabled gzip compression, reduced batch size to prevent gRPC errors.
• Updated output from packages_only=true so that it only returns software with available installers.
• Added tarballs summary card back into UI.
• Improved the sorting of batch scripts in the Batch Progress UI. Batches in the "started" state now sort by started date, and batches in the "finished" state now sort by the finished date.
• Removed inaccurate host count timestamp on the software version details page.
• Downgraded "distributed query is denylisted" error to a warning on the Fleet server since this message indicates a likely issue on the host and not the server. We will surface this issue in the UI in the future.
• Improved performance for YARA rules: when modifying config (PATCH /api/latest/fleet/config) with a large number of yara rules and when large numbers of hosts fetch rules via /api/osquery/yara/{name} endpoint.
• Improved performance when updating multiple policies in the UI. The policies are now updated in series to reduce server/DB load.
• Added user icon to OS settings custom profiles on host details page if they are user scoped.
• Added clearer error messages when a new password doesn't meet the password criteria.
• Removed extra spacing from under disk encryption table.
• Updated fleetctl get mdm-command-results to show output in a vertical format instead of a table.
• Optimized os_versions API response time.
• Added logic to detect and fix migration issues caused by improperly published Fleet v4.73.2 Linux binary.
• Refactored ApplyQueries DS method so that queries are upserted in batches, this was done to avoid deadlocks during large gitops runs.
• Refactored the way failing policies are computed on host details endpoint to avoid discrepancies due to read replica delays and async computation.
• Refactored PATH fleet/config endpoint to use the primary DB node for both persisting changes and fetching modified App Config.
• Fixed missing ticket integration options in Policies -> Other workflows modal for teams.
• Fixed deduplicating bug in UI to only count unique vulns when counting software title vulnerabilities across versions in various software title vulnerabilities count, and host software title vulnerabilities count.
• Fixed cases where the default auto-install policy for .deb packages would treat installed-then-uninstalled software as still installed.
• Fixed the message rendered from user_failed_login global activities on the Activity feed if the email is not specified.
• Fixed fleetctl printing binary data to terminal in debug mode.
• Fixed a bug where incorrect CVEs were received from MSRC feed.
• Fixed Fleet-installed host count not updating after software is installed over an older version.
• Fixed UI issue in the Dashboard page. The software card is now rendered while content is been fetched to avoid the layout to jump around.
• Fixed error when updating a script to exactly match the contents of another script.
• Fixed an issue where string concatenations in a LIKE expression caused a syntax error in the query editor.
• Fixed fleetctl gitops issue uploading an Apple configuration profile with a FLEET_SECRET in a <data> field.
• Fixed Linux lock script on Ubuntu with GDM to now switch UI to text mode to work around GUI issues.
• Fixed Google Cloud Storage (GCS) support broken since Fleet 4.71.0 by implementing a workaround for AWS Go SDK v2 signature compatibility issues with GCS endpoints.
• Fixed banner link colors in UI.
• Fixed an alignment issue on the My device page.
• Fix deadlocks when updating automations for 10+ policies at one time.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.47.2
2. fleet-desktop-v1.48.1 (included with Orbit)
3. fleetd-chrome-v1.3.3

While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

530df71bda192c2468c2d0e26bfbcd76137decab25c7f80749e67c6bdce84167  fleet_v4.74.0_linux.tar.gz
fa54e95129c4c33dd15245de7107cbcea666c9b83fc5facc54f1be9995ab1984  fleetctl_v4.74.0_linux_amd64.tar.gz
94865880a4514d2a0ccfb6e47746d13b030675286f8053b4e274934144b6a140  fleetctl_v4.74.0_linux_amd64.zip
d1ae2a3ab9d51456cda7fe3e165f2a42213db95090d3a92bb94ebf302bd61b77  fleetctl_v4.74.0_linux_arm64.tar.gz
63acdbcbea1de155a45381e97dfb86cff286ff8d551ca803292fada84171153f  fleetctl_v4.74.0_linux_arm64.zip
751d6b30d2cb0afd040fce9af784305c1a72c5d129fe1df1e47cd1a280f81019  fleetctl_v4.74.0_macos.tar.gz
696c8e59a2890bf03e68359db62ea5994ae273202748bc7fbdc6a6ab22761783  fleetctl_v4.74.0_macos.zip
44a549e26072d749a5328e8fbf2a831cfc69689254a9c424d13a862b41a232ac  fleetctl_v4.74.0_windows_amd64.tar.gz
2cefc31893421fb2400d88323c5fbef0e6d57ec52fe5473eda2d6aaac563ee1d  fleetctl_v4.74.0_windows_amd64.zip
701d0df3ad16e370303eca9cc16d0669079c93d0835e8513aa5e06187b069038  fleetctl_v4.74.0_windows_arm64.tar.gz
9f03fdde86877beb19547fcd09473edb65dec20c650598e4ae26f932f9df66b0  fleetctl_v4.74.0_windows_arm64.zip

Bug fixes

• Added logic to detect and fix migration issues caused by improperly published Fleet v4.73.2 Linux binary
• Removing the software renaming fix introduced in 4.73.3 due to MySQL DB performance issues.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

edf98e19e61f63f4f6143f325e6a7eeef777ef48f3e7682d0b0d6bbf1995daa3  fleet_v4.73.4_linux.tar.gz
e805fd97450f04f5e8bfef436f798998eb37118a0c849b58155b4480da3f51f0  fleetctl_v4.73.4_linux_amd64.tar.gz
20cc65fdda7738646219bc36cdeb6f8ca702cbf46fcef0f7e20fd8fb0976b92b  fleetctl_v4.73.4_linux_amd64.zip
50dd3c882b487c1ff9fac7deaa6bd7e1912ee2296aee9d05adab8daa909a9a24  fleetctl_v4.73.4_linux_arm64.tar.gz
958875f37dae9a1f5ca30f336bc3eecf0da006a75cefe0ecb2a787498a26f165  fleetctl_v4.73.4_linux_arm64.zip
a34261aeb76d61cfc14e58923636f75c43dbaba337a25d36d6c71144bc0de131  fleetctl_v4.73.4_macos.tar.gz
a74bcb8e265ebebbb92fe3b7c8d99164c7a412e544724ae90c5fc9e44592ac3c  fleetctl_v4.73.4_macos.zip
3a22ccba53366baf3da55b19a9a2e91027ebac22db6cda88c3c03cdf9cea3069  fleetctl_v4.73.4_windows_amd64.tar.gz
c02973c12472c730cf1a24b1d6dad5a6360267a9059dd1bc4a1c1ac67c23cabb  fleetctl_v4.73.4_windows_amd64.zip
5dce20f2b79ebcc4c9333e8f68bbadf0f76bbc47a2a4fedf1154b123632c4924  fleetctl_v4.73.4_windows_arm64.tar.gz
b240008226f216c37d820272e53549b68ea2fc0d61ff6790c81cbf8d9a9bf7fa  fleetctl_v4.73.4_windows_arm64.zip

NOTE: We have received reports of increased database load during software ingestion in v4.73.3. A fix is in progress and will be included in v4.73.4.

Bug fixes

• Improved software ingestion DB lock times by pre-inserting software/titles in smaller batches when hosts check in.
• Re-added and optimized fix for macos software ingestion to prevent duplicate software due to end user renaming software on host.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

934cdb6fd20afb029fd99608d7972af2ae4658580362b505faa4ca0a06bcb96c  fleet_v4.73.3_linux.tar.gz
19eb88339d929ffd07c72dce7e41817f0cd316a7a4c89c7adab34ba228ed08ed  fleetctl_v4.73.3_linux_amd64.tar.gz
ce318c62458f5425e00204f91c66e05ab3d66da5c59541d4723c254ff7683f21  fleetctl_v4.73.3_linux_amd64.zip
8174d7de77065a7b50e82f83691c50fca8144ffcbbbcdb199f5d59ba30a35b8f  fleetctl_v4.73.3_linux_arm64.tar.gz
2f517fed155756a3c8377813d1655454beb15ab20428680b2e444ac793b9c14f  fleetctl_v4.73.3_linux_arm64.zip
48f293af536ab72d0a6ff9b9643df6e9cbe82cb9e6b197de24c465df15a4d574  fleetctl_v4.73.3_macos.tar.gz
e8f353c1fb9d1cf6183393a987ffb09a6796cb8b244e4af9cacb1b63f6c7b55d  fleetctl_v4.73.3_macos.zip
e73f53fc4d546e1af86bebecbd9b0accd2ab2c803c3f48d969eabb4708cd674d  fleetctl_v4.73.3_windows_amd64.tar.gz
86b93bc8fbaac95e8c6082633e6e2c47a7685d8a6d9952dd35a34dfad740dda4  fleetctl_v4.73.3_windows_amd64.zip
f38f43ef9478985ef342ac1cb70491c11ec9453d017346177ade5cde0a9fb1df  fleetctl_v4.73.3_windows_arm64.tar.gz
e06bdc22cde34ad22080c126a3d8816d8cb143bf31e59addf8949ffb90c1efb2  fleetctl_v4.73.3_windows_arm64.zip

Bug fixes

• Optimized the query used to list a host’s script results so it performs well with large result sets.
• Fixed MySQL DB performance regressions introduced in Fleet 4.73.0/4.73.1 affecting OS versions and software titles read queries.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

e72f2f9760e09931d1aed05fbe48ac2e16e1b788deb2faffa053d2d0669da89c  fleet_v4.73.2_linux.tar.gz
e48eeb6de0b3ed3eb179cd31818e51b86d86d5ba3f1af5af44605c6ebcc22d05  fleetctl_v4.73.2_linux_amd64.tar.gz
bc8cdf540e25ef0b7574f02e19e26124ba46a46e79f6b43a07c2d47d4bce74a5  fleetctl_v4.73.2_linux_amd64.zip
87716778ae105fb78d5f0cece665399aab47fc9b28acab6a71f1d12e514f2f5f  fleetctl_v4.73.2_linux_arm64.tar.gz
0e9925abdbbf57702ee209ece0db7ab8578cbb927cfad92398bd858277bc8bf7  fleetctl_v4.73.2_linux_arm64.zip
c35c622cc8b58636290487b062052f07719f0dc54ee466ddf1f4490d0724e05c  fleetctl_v4.73.2_macos.tar.gz
2473e7ac284f18997a3c16db853c2adac7776046dc5ac32ff6d6bab61325a048  fleetctl_v4.73.2_macos.zip
225ae8ea860e41868da7a538a3d8bf9e565cd03951c37f4d2e16e3f55c8c9746  fleetctl_v4.73.2_windows_amd64.tar.gz
4cb519cf0daeb6591e378a5543f4ecead7dee32d158620b32a918e6dc5890e56  fleetctl_v4.73.2_windows_amd64.zip
7ed349f9b0c43ee871fc27593f0569e52dc462b6a00a333c43405e546c8ae8a9  fleetctl_v4.73.2_windows_arm64.tar.gz
3f45ec61dd14b9c6ac521f7918c253cd8747bf84ff302a8070b18fecc53accd1  fleetctl_v4.73.2_windows_arm64.zip

Bug fixes

• Changed MDM Enrollment logic so that devices identified as having a Migration deadline by ABM will not run Setup Experience on the next enrollment(the migration) but will on subsequent enrollments.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

0d288befb312c7d6a3c5749c8cb8cd948c25cb5486156df844e2b22eb35d2c9a  fleet_v4.73.1_linux.tar.gz
b52b5c0dc96bb204dca4a25a1dcf6a7c36a39d52112e67e37b2447be741368f8  fleetctl_v4.73.1_linux_amd64.tar.gz
8667caacf971fb4ac40f119ec9bb57357eaaf5c4420dfef4abfc29fe251833e5  fleetctl_v4.73.1_linux_amd64.zip
f867e50edc159c252c6eadf6b6cfca246aa287e3c9aaa17db3afb62a85c3838b  fleetctl_v4.73.1_linux_arm64.tar.gz
e53220419b97a33635c0973412797371a2390e6dee353d236ce35d90a59189af  fleetctl_v4.73.1_linux_arm64.zip
1a45c44f3b648ec534dc8d78664d24d03f49df3343c13a29ca2e90c651813219  fleetctl_v4.73.1_macos.tar.gz
9fff7ad7a50ad024ead7fa470b2d5d8ae1f9388e36e2ef7b5382efd4fa6c0ec1  fleetctl_v4.73.1_macos.zip
f2e782c278da1cba3092c056913517a4c51bb0ea2f4ef6cf1eae37e9311221e6  fleetctl_v4.73.1_windows_amd64.tar.gz
d2706f08ff2a61ca9ca6eaa0bf1e80d81f9ae032d6b47dac7adc66f0c020a287  fleetctl_v4.73.1_windows_amd64.zip
e4ce4d0cdcb5c7a754b333f34f18b3af0465b3584d4ddef7912a532135575d60  fleetctl_v4.73.1_windows_arm64.tar.gz
8c0944a6ea1c964f811f480d12353ef926a46ef37a3a02a3605bd6fe3972789e  fleetctl_v4.73.1_windows_arm64.zip

Fleet 4.73.0 (Sep 8, 2025)

Security Engineers

• Added new detail query, only executed if TPM PIN enforcement is required, for determining whether a BitLocker PIN is set.
• Added host identity certificate renewal support for TPM-backed certificates (Linux-only). When a certificate is within 180 days of expiration, orbit will automatically renew it using proof-of-possession with the existing certificate's private key.
• Added new global activity created when a new disk encryption key is escrowed.
• Added issuer and issued cells to the host details and my device page certificates table.
• Allowed filtering host and team software by minimum and maximum CVSS score in the Fleet UI.
• Updated UI to display kernel vulnerabilities in the operating system details page for Linux systems.
• Updated macOS 13 CIS policies to align with CIS Benchmark v3.1.0 (from v3.0.0).
• Updated macOS 14 CIS policies to align with CIS Benchmark v2.1.0 (from v2.0.0).
• Updated macOS 15 CIS policies to align with CIS Benchmark v1.1.0 (from v1.0.0).
• Updated Fleet's certificate ingestion to accept non-standard country codes of longer than 2 characters. In addition, updated ingestion of other fields to truncate long values and log an error instead of failing.

IT Admins

• Added API endpoints for adding, deleting and listing secret variables.
• Added ability to add and delete custom variables in the UI.
• Added APIendpoints to get and list batch scripts.
• Added cron job to launch scheduled batch scripts.
• Added API endpoint to cancel scheduled batch script run.
• Added the ability to cancel batch script runs directly from the UI summary modal.
• Added ability to schedule batch script runs in advance to the "Run scripts" modal.
• Added the ability to filter the hosts list to those hosts that were incompatible with the script in a batch run.
• Added side navigation on the Controls > Scripts page, with the previous Scripts page content under the "Library" tab and a new "Batch progress" tab containing details about started, scheduled, and finished scripts.
• Added batch execution IDs to script run activities.
• Added IdP SSO authentication to the BYOD mobile devices enrollment if that option is enabled for the team.
• Allowed overriding install/uninstall scripts, and specifying pre-install queries and post-install scripts, for Fleet-maintained apps in GitOps.
• Added support of $FLEET_VAR_HOST_UUID in Windows MDM configuration profiles.
• Added additional logging information for Windows MDM discovery endpoint when errors occur.
• Added support for last opened time for Linux software (DEB & RPM packages).
  • NOTE: Package will need to be updated out-of-band once, because the pre-removal script from previously-generated packages is called upon an upgrade. The old pre-removal script stopped Orbit unconditionally. fleet-osquery can safely be updated through the Software page only after a new package generated with this version of fleetctl has been installed through other means.
• Added indication of whether software on a host was never opened, vs. being a software type where last opened time collection is not supported.
• Added automatic install policies into host software responses.
• Updated fleetctl api to now support sending data in the body of non-GET requests using the -F flag. (Thanks @fuhry!)

Other improvements and bug fixes

• Added permissions to OS updates page so that only global admins and the team admin can see the page.
• Cleared label membership when label platform changes (via GitOps).
• Improved public IP extraction for Fleet Desktop requests.
• Marked DDM profiles as failed if response comes back with Unknown Declaration Type error, and improve upload validation for declaration type.
• Modified PUT /api/v1/fleet/spec/secret_variables endpoint to only accept secret variables with uppercase letters, numbers and underscores.
• Updated software inventory so that when multiple version of a software are installed the last used timestamp for each version is properly returned.
• Revised stale vulnerabilities deletion (for false positive cleanup) to clear vulnerabilities touched before the current vulnerabilities run, instead of using a hard-coded threshold based on how often the vulns cron runs.
• Removed unintended broken sort on Fleet Desktop > Software > type column.
• Validated Gitops mode URL on frontend and backend.
• Updated to not log an error if EULA is missing for the /setup_experience/eula/metadata endpoint.
• Loosened validation during GitOps dry runs for software installer install/uninstall scripts that contain Fleet secrets.
• Added missing checks for invalid values before trying to store them in DB.
• Updated styles for turn on MDM info banner button.
• Updated so that DEB and RPM packages generated by fleetctl package to now be safe to upgrade in-band through the Software page.
  • If you have a DEB or RPM fleetd package that you uploaded to your Fleet Software page which will be used to upgrade an older fleetd on your Linux hosts, please re-generate and re-upload that package to the Fleet server.
• Updated so that individual script executions from batch jobs are now hidden from the global feed.
• Updated to attest the signed Windows Orbit binary instead of the unsigned one.
• Updated both Fleet desktop and osquery for macOS and Windows artifacts to attest the binaries inside archives.
• Made sure that if disk encryption is enabled and a TPM PIN is required, the user is able to set a TPM PIN protector.
• Removed DeferForceAtUserLoginMaxBypassAttempts from FileVault profile, to use default value of 0 to indicate the FileVault enforcement can not be deferred on next login.
• Updated go to 1.24.6.
• Fixed cases where the uninstall script population job introduced in Fleet 4.57.0 would attempt to extract package IDs on software that we don't generate uninstall scripts for, causing errors in logs and retries of the job.
• Fixed potential panic in error handler when Redis is down.
• Fixed a potential race condition issue, where a host might get released because no profiles has been sent for installation before releasing the device, by checking the currently installed profiles against what is expected.
• Fixed invalid rate limiting applied on Fleet Desktop requests for which a public IP could not be determined.
• Fixed VPP token dropdown to allow user to choose "All teams" selection.
• Fixed an issue where Windows configuration profiles fails to validate due to escaping data sequence with <![CDATA[...]]> and profile verifier not stripping this away.
• Fixed an issue where a host could be stuck with a "Unlock Pending" label even if the unlock script was canceled.
• Fixed 5XX errors on /api/v1/fleet/calendar/webhook/* endpoint due to missing authorization checks.
• Fixed server panic when listing software titles for "All teams" with page that contains a software title with a policy automation in "No team".
• Fixed operating system icons from bleeding into software icons.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.47.2
2. fleet-desktop-v1.47.2 (included with Orbit)
3. fleetd-chrome-v1.3.3

While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

e6e611867bdc5e3949a2c2b53eecd1fc6e679a2a0da6e6249547629bd986a02c  fleet_v4.73.0_linux.tar.gz
f01a004d6d2395951b8099dc28e28daad9c700d4e1e4c8188263aee538b68312  fleetctl_v4.73.0_linux_amd64.tar.gz
c9648ea4c4aea716039f54ade2f778ae7d5a6ffc6c6c7025fe2dc303f7879689  fleetctl_v4.73.0_linux_amd64.zip
31a3eb8a6c562eb67a5a702894c813ec99c251962221f89f13fca318cd267d02  fleetctl_v4.73.0_linux_arm64.tar.gz
33b9e55414572ada27cd49edcd491d54c4cc333451822453357b400d9f99d28b  fleetctl_v4.73.0_linux_arm64.zip
dd74cf3db664015dd159dff3ec888540d9c95bffa31f4c6bc329ea44d4df6011  fleetctl_v4.73.0_macos.tar.gz
5595bb3f8c2a596090d9b4d1285eec051f658f5c65c075f9e26d28fe9d52de68  fleetctl_v4.73.0_macos.zip
4a58eec5619739df5789d229dc4ac44393594beafa9277924ec9c728bf2dc70c  fleetctl_v4.73.0_windows_amd64.tar.gz
0f253d47e437875d874ac1db63103ac60faa71c4997d2749ccdfaf00fec4e969  fleetctl_v4.73.0_windows_amd64.zip
526af3178b6cc64c9b6e90fe76ba27fff2e043f25c74b2ed42de09f09b74fe49  fleetctl_v4.73.0_windows_arm64.tar.gz
6b316179f78f78f7aee4303a55f8144ee6308e189ee30f2970ccfc3da5284d2c  fleetctl_v4.73.0_windows_arm64.zip

Bug fixes

• Fixes a potential race condition issue, where a host might get released because no profiles has been sent for installation before releasing the device, by checking the currently installed profiles against what is expected.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

2b2d83546c2dd5ccccbf545ea75fa17173df09ef8996efb013f7c98655b83a63  fleet_v4.72.1_linux.tar.gz
e7fae8c449ed887a6c69edfa365e8176570ab03e3119b61683ada8407d10aa11  fleetctl_v4.72.1_linux_amd64.tar.gz
6d7751492efafc926ee371dfe9c953c3f8587302d5f12a92b26f8d49b8133d62  fleetctl_v4.72.1_linux_amd64.zip
99b6ff2f359ba283a6c6913406b9b58a8aae6c23964abe8b7aa9d92461367bdb  fleetctl_v4.72.1_linux_arm64.tar.gz
5a72513466c4855f9f5620d7ae1b694a66552fad861e144af83b1a98e4fbd5c2  fleetctl_v4.72.1_linux_arm64.zip
68858195d61ff1e9687a8238732cbe966f2ded2e554d4e95b32ed6a03616f9e3  fleetctl_v4.72.1_macos.tar.gz
98477c315d79282f6d80f0fe93275cc96e5fb5d1255f44ab3515dd92cd2d15ff  fleetctl_v4.72.1_macos.zip
277762309ac8dbdd3281b104eb7776ede595f0d76309a7553d350c262d37bbf9  fleetctl_v4.72.1_windows_amd64.tar.gz
27f0c5cf297b20d94fd4d27adb02c748248d16786944f954b2dc2af7c0c980e6  fleetctl_v4.72.1_windows_amd64.zip
061a0f04231dfc4c4fee549cca1baf207911b271af3dc01992783f6cc3e715d5  fleetctl_v4.72.1_windows_arm64.tar.gz
7be763b8335f7d1d888c851ac02cadbbb7e7f22c1a174bd386dae8421e088d1f  fleetctl_v4.72.1_windows_arm64.zip

Fleet 4.72.0 (Aug 13, 2025)

Security Engineers

• Added support for issuing host identity certificates through SCEP (Simple Certificate Enrollment Protocol) that fleetd can use with TPM 2.0 hardware to cryptographically sign all HTTP requests.
• Added flag --fleet-managed-host-identity-certificate to generate fleetd packages for linux that use TPMs to sign HTTP requests.
• Added sso_server_url configuration option to support SSO setups with separate URLs for admin access vs agent/API access. When set, SSO authentication will only work from the specified URL. This fixes SSO authentication errors for organizations using dual URL configurations.

IT Admins

• Added support for Apple Account Driven User Enrollment for iOS/iPadOS when end user authentication is configured.
• Added support for MS-MDE2 v7.0 Windows MDM Enrollments.
• Added the following Fleet-maintained apps for macOS: iTerm2, Yubikey Manager, VNC Viewer, Beyond Compare.
• On the host details > software > library page and Fleet Desktop > Self-service page, show installer status and installer actions based on what software is detected in software inventory.
• On the host details > software > library page and Fleet Desktop > Self-service page, show user's when a software can be updated, allowing users to easily trigger a software update and see fresh data after an update completes.
• Updated VPP apps reported by osquery to retain their last install information when viewed in host software library.
• Switched to more comprehensive UpgradeCode based uninstall scripts when an UpgradeCode can be extracted from an MSI custom package.

Other improvements and bug fixes

• Added support for fleetd TUF extensions on Linux arm64 and Windows arm64 devices.
• Added a fallback to package install path for extracting app names from uploaded PKG packages.
• Added special handling for version extraction of Fleet-maintained app manifests that reference a download URL that isn't version-pinned.
• Improved fleetctl gitops type error mesages.
• Improved accuracy of auto-install queries for custom MSI packages by using a better identifier.
• Label created_at no longer factored in when scoping software packages by "exclude any" manual labels.
• Refactored AddHostsToTeam method to fix race condition introduced by global var.
• Changed enable_software_inventory to default to true if missing from gitops config.
• Modified backend for GET /api/v1/fleet/commands when filtering by host_identifier to address performance concerns and exhausting database connections when API is called concurrently for many hosts.
• Allowed users of Fleet in Primo mode to access Software automations and failing policy ticket & webhook automations.
• Update UI to support personally enrolled MDM devices.
• Removed DEB and RPM installers from installable software lists on hosts with incompatible Linux distributions (e.g. Ubuntu for an RPM).
• Revised MSI uninstall scripts to wait for an uninstall to complete before returning and avoid restarting after an uninstall.
• Added back software mutation on ingestion to fix non-semver-compliant software versions, starting with DCV Viewer.
• Increased timeouts on /fleet/mdm/profiles/batch to better support customer workflows with large numbers of profiles.
• Made consistent and update the Install and Uninstall detail modals for VPP and non-VPP apps across the Fleet UI.
• Updated go to 1.24.6.
• Fixed issue with package ids ordering causing software installers' scripts to be inconsistently generated.
• Fixed incorrectly displayed status in controls OS Settings page, if a host was only pending or failing on declaration for removal.
• Fixed bug with mdm_bridge Orbit table that caused panics due to invalid COM initialization.
• Fixed bug where a certificate Distinguished Name (DN) parser did not allow forward slashes in the value which resulted in parsing error.
• Fixed an issue where the detected date for software vulnerabilities was not being pulled correctly from the database.
• Fixed missing empty host lists on manual labels in gitops.
• Fixed an issue where two banners would sometimes be displayed on the host details page.
• Fixed missing webhook url in automations tooltip.
• Fixed an issue where using ESCAPE in a LIKE clause caused SQL validation to fail.
• Fixed error when trying to escrow a linux disk key multiple times.
• Fixed silent failure when passing flags after arguments in fleetctl.
• Fixed wrongly formatted URL for EULA when accessing from Fleet UI and when shown in the iFrame for SSO callback.
• Fixed stale pending remove apple declarations, if the host was offline while adding and removing the same declaration.
• Fixed a case where a vulnerability would show up twice for a given operating system.
• Fixed specification of policy software automations via GitOps when referring to software by hash from a software YAML file.
• Fixed cases where the vulnerabilities list endpoint would count the same CVE multiple times for the count field returned with a result set.
• Fixed an issue where SSO URLs with trailing slashes would cause authentication failures due to double slashes in the ACS URL. Both regular SSO and MDM SSO URLs now properly handle trailing slashes.
• Fixed an issue during the DEP sync where errors such as 404 from the DEP API could result in devices never being assigned a cloud configuration profile.
• Fixed server panic when listing software titles for "All teams" with page that contains a software title with a policy automation in "No team".

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.45.1
2. fleet-desktop-v1.45.1 (included with Orbit)
3. fleetd-chrome-v1.3.2

While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

92a387763538e1acd46c582cc7124ee405dfc8e43cdaf3206a5c742f458f3582  fleet_v4.72.0_linux.tar.gz
73e6e271339cabd060ddbc449d3f883d5474db5d5dcb7b493c2c7a018cdb32e5  fleetctl_v4.72.0_linux_amd64.tar.gz
dfcdf025b9b5ded3f720f67c0bef6533e92809426a5aac4064c166e44637f2a0  fleetctl_v4.72.0_linux_amd64.zip
da46a740b2646c3463924d2e755ce92ad4e81a6851b4d3c2c8e6f4fce7d5b2f5  fleetctl_v4.72.0_linux_arm64.tar.gz
c928de0478878829068a8ca625d3a971588baa44d6d78fb003e168563f612972  fleetctl_v4.72.0_linux_arm64.zip
0c71d31bb852e3d585bf33bcb52746418d43ab5fc4beca642ff2b133a2812b1a  fleetctl_v4.72.0_macos.tar.gz
983d407c345a3c8ef47bfa8a510f1ab0b4f710dc5f07f40b6c980837546e3d36  fleetctl_v4.72.0_macos.zip
c2696949505caf5521221200f1f6ecbc259e8d2fcd5c9b4a382927defb3cd6df  fleetctl_v4.72.0_windows_amd64.tar.gz
db953e7791905deba5984e7e813bc41a9fb56292fea5facf6499a88b995b64ae  fleetctl_v4.72.0_windows_amd64.zip
a97965b3fe3e9889ec5db92e8a367921dcc7677e6114bc6ca927c8c941f82021  fleetctl_v4.72.0_windows_arm64.tar.gz
86678801be06f9f361e9fed9c97477b9975ad66d39db71f6c999ab04862fcdea  fleetctl_v4.72.0_windows_arm64.zip

Bug fixes

• Added sso_server_url configuration option to support SSO setups with separate URLs for admin access vs agent/API access. When set, SSO authentication will only work from the specified URL. This fixes SSO authentication errors for organizations using dual URL configurations.
• Fixed an issue where SSO URLs with trailing slashes would cause authentication failures due to double slashes in the ACS URL. Both regular SSO and MDM SSO URLs now properly handle trailing slashes.
• Added support for MS-MDE2 v7.0 Windows MDM Enrollments

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

5ccb98feafffd94833d2a351789f83df587cc103088462ffb0efcc20471fa952  fleet_v4.71.1_linux.tar.gz
adac200aab77def642f44b656f2b8fcfde54114c41e38f08825cc9a50bf3d1c3  fleetctl_v4.71.1_linux_amd64.tar.gz
de9e9dc3b4545475c4675a366066de5b88129875c7755026d6af167b5497287f  fleetctl_v4.71.1_linux_amd64.zip
e0d3c44cb4111fa213a89b8a759df7b39adc630c15bb554be67d28ed7415013b  fleetctl_v4.71.1_linux_arm64.tar.gz
dc67fa38f8df1053ea06b0ddb769c7f12ea59671edb5143e046c8091948a158f  fleetctl_v4.71.1_linux_arm64.zip
3bb55c16ef401c690509b93f71eee4fa7230f9ee46058ae9de5d91643edd3840  fleetctl_v4.71.1_macos.tar.gz
24851da8de060b76414820a86664965f0b99e2893a1f78933df59ad984c2f033  fleetctl_v4.71.1_macos.zip
5b9d2ee0f048fac46807ba51c0238f7ca6498b835f5d09cc315d0d195d3935ce  fleetctl_v4.71.1_windows_amd64.tar.gz
0dc19ca5227553f4b6c425f7dc8feee76b5293764b162a979bd29d4dad71204f  fleetctl_v4.71.1_windows_amd64.zip
dec0078b965e5dd94186a4e3e06dcd0b76560b6573425da7e2f0a511be4d8ddf  fleetctl_v4.71.1_windows_arm64.tar.gz
53ac2b2fb216ea74f316ad7f83a849e649728a5b055fc71ea4ac96e7874572b7  fleetctl_v4.71.1_windows_arm64.zip

Fleet 4.71.0 (Jul 23, 2025)

Security Engineers

• Updated CIS benchmarks for Windows 10 to version 3.
• Added support for IdP-based labels.
• Added last opened time for Windows applications.
• Updated GET /hosts/:id/encryption_key to return most recently archived encryption key if current key is not available.
• Added support for ingesting user's "Department" via SCIM and added support to set the FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT variable on configuration profiles.
• Cleaned up false-positive vulnerabilities on Amazon Linux 2 hosts reported in Fleet <= 4.55.

IT Admins

• Added the verification of user-scoped profiles on macOS.
• Added last opened time for Windows applications.
• Updated Windows Custom OS Settings including Win32/Desktop Bridge ADMX policies to now be marked verified after the host has acknowledged the MDM install command.
• Added support for "Host Vitals" label, starting with IdP-based labels which update automatically.
• Added automatic refetches of host vitals and software inventory after a successful software install or uninstall.
• Updated GET /hosts/:id/encryption_key to return most recently archived encryption key if current key is not available.
• Increased how often Fleet checks for new Fleet-maintained apps, from once per day to once per hour.
• Improved GitOps speed when managing software with hashes on a large number of teams.
• Separated host details software list into two separate sections: Inventory (software installed on a host) and Library (software available for installation on a host).
• Updated Apple profile verification code to disallow uploading profiles with the same identifier but differing PayloadScopes.
• Recorded installer URL when a Fleet-maintained app is added via the web UI or REST API.
• Added support for ingesting user's "Department" via SCIM and added support to set the FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT variable on configuration profiles.
• Added support for the Apple MDM user channel. When a mobileconfig with a payloadscope of User is targeted for a host with a user channel connection, it will now be sent to the user channel.
• Added ability to add EULA end user sees during setup experience via gitops.

Other improvements and bug fixes

• Switched VPP apps to show as installed only after MDM confirms the app is installed, instead of when the installation command is acknowledged.
• Added user property api_only to backend activity details.
• Replaced email with user full name for login activity.
• Added a new avatar for API-only users in the activity feed.
• Updated side navigation styles across the app.
• Added premium tier messaging to the certificates section on the integrations page.
• Removed ability to upload a EULA in the UI if gitops is enabled.
• Migrated from aws-sdk-go v1 to aws-sdk-go-v2.
• Optimized database queries for MDM enrollment checks when one host is being checked at a time.
• Replaced own SAML implementation with https://github.com/crewjam/saml.
• Increased page size for software versions shown on the software view page from 5 to 10.
• Added retries in PATCH policies API requests to fix deadlock errors in "Manage automations" page.
• Added missing team_name property on /api/v1/fleet/hosts/identifier/:id endpoint.
• Added missing "url" parameter when exporting YAML on software packages that have a URL specified (thanks @drvcodenta!)
• Improved performance when pulling team settings on osquery config and distributed read endpoints.
• Allowed team selection and name updates when saving a copy of an existing query as a new query.
• Updated Fleet maintained apps uninstall script to use pkgutil to remove applications files.
• Added functionality for verifying installation of VPP apps.
• Moved the SSO and Host status webhook settings from Settings > Organization to Settings > Integrations.
• Updated software installed activities created during setup experience correctly categorized as from automation.
• Fixed cases where valid operating system vulnerabilities would be periodically incorrectly purged.
• Fixed details not showing when the device page URL was edited.
• Fixed an issue where the fleetctl codesignature requirements couldn't be used to verify the codesignature of fleetctl.
• Fixed issue where IdP integration page did not show the premium feature message.
• Fixed bug present on gitops cmd when importing no-team.yml with scripts without default.yml.
• Fixed a bug where Fleet-maintained app updates via GitOps wouldn't pull the latest version of Google Chrome on each run, and would display an invalid SHA256 hash in the UI and API.
• Fixed host API to returns empty array (instead of 404) if software title or version is not found on hosts on that team consistent with other host filters.
• Fixed bug with the run script modal on the Hosts page when running under FreeTier due to invalid teamId filter.
• Fixed a case where host software counts wouldn't be updated if the host_software database table included one or more rows with a zero software_id.
• Fixed issue where attempting to lock an MDM-unenrolled macOS host was not returning the expected error.
• Fixed error when deleting a calendar event for a Google Workspace user that no longer exists.
• Fixed fleetctl panic caused by missing SSO settings during gitops generate.
• Fixed software title ID + installer status filters to return an empty array with 0 count instead of 404 when an installer is not present on a team.
• Fixed issue where iOS devices were not refetching at the expected cadence when re-enrolled without first deleting the host.
• Fixed cases where valid operating system vulnerabilities would be periodically incorrectly purged.
• Fixed issue with PATCH /fleet/scim/Groups/<group name> endpoint handling duplicate entries.
• Fixed bug with calendar/webhook endpoint that caused an error if the calendar event relates to a deleted host.
• Fixed host details > MDM OS settings tooltips from flashing during a host refetch.
• Fixed an issue where macos_setup would not always be exported by fleetctl generate-gitops when it should have been.
• Fixed host certificate source recording (including associated performance/database load issues) when multiple hosts share the same certificate on user keychains with differing usernames.
• Fixed software package version output in generated GitOps YAML.
• Fixed truncation of the MDM server url value on the about card on host details page.
• Fixed a bug that prevented users from adding VPP apps to macOS setup experience if the iOS version of the app was also added to their team software library.
• Fixed cases where installed-then-uninstalled software would show up in software inventory.
• Fixed automation tooltip not showing the correct filesystem log destination.
• Fixed SSO settings page returning 500 when SSO settings are undefined.
• Fixed the linux uninstall script.
• Fixed broken macOS users causing errors during query ingestion.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.45.1
2. fleet-desktop-v1.45.1 (included with Orbit)
3. fleetd-chrome-v1.3.2

While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

9aadd3195508920306d46918f6b27e4888b43a659070f58bf541a3aaf2ec38e9  fleet_v4.71.0_linux.tar.gz
2415a2939e7d3a6959eb5bd1403289d3fd6dd06ede9e64d2cbb398eb464e2f16  fleetctl_v4.71.0_linux_amd64.tar.gz
8818b643411f6116309a1c7628ebc804eba4c8e4d9228cc6f6d4447e62f50279  fleetctl_v4.71.0_linux_amd64.zip
e3706ba14e808571ab88f7469560ce16b98b70583a2a5f76d60f86e6fc5c90d5  fleetctl_v4.71.0_linux_arm64.tar.gz
2a3076f916ab1fd68add031d2e565c3335879dc68b9584d2a3445ce7fc73f972  fleetctl_v4.71.0_linux_arm64.zip
2a7cbfacf320cf8b498d28f59a5e05dccf375760dcd1fc5d1b562160934d8d8a  fleetctl_v4.71.0_macos.tar.gz
fda22d71d9e25b4bf9c4d2d5623aa9167b7f3c3ad489782b3ef0bedc944b7912  fleetctl_v4.71.0_macos.zip
78eaf3115e8e72a7e54acafd75235853126b3b0eddfd784243ef5433dc15186a  fleetctl_v4.71.0_windows_amd64.tar.gz
711d5d1afb043c4b8b70fea320d8dcb31ccc3050e569b894a206b9c97adf25df  fleetctl_v4.71.0_windows_amd64.zip
cdb2c3c678a17ddf11a956b4ea40d105e64c0ae2e18c530b93806b69620ba7fc  fleetctl_v4.71.0_windows_arm64.tar.gz
4994f8af4d41d020a9a8e66337ea238f3675d1421603245b54d7756771c92af3  fleetctl_v4.71.0_windows_arm64.zip