Fleet device management

vfleet-v4.86.2 scope: fleet Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo Configuration Management

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

binary-authorization configuration-management device-management gitops ios linux

+11 more

macos mdm orchestration osquery patching powershell scripting security software-management telemetry vulnerability-management

Summary

AI summary

Updates Bug fixes, https://fleetdm.com/docs/deploying/upgrading-fleet, and https://fleetdm.com/docs across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Bugfix
Bugfix	High	Fixes Fleet start failure on read-only root filesystem by storing org logos in database instead of disk. Fixes Fleet start failure on read-only root filesystem by storing org logos in database instead of disk. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	High	Fixes missing host vitals labels for fleet/team scopes due to incorrect SQL join. Fixes missing host vitals labels for fleet/team scopes due to incorrect SQL join. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	High	Fixes server out‑of‑memory crash caused by repeated Apple VPP API transient errors. Fixes server out‑of‑memory crash caused by repeated Apple VPP API transient errors. Source: llm_adapter@2026-06-13 Confidence: high	—

Full changelog

Bug fixes

Fixed Fleet failing to start on a read-only root filesystem by storing custom org logos in the database when no S3 software installers bucket is configured, instead of writing to local disk.
Fixed a bug where host vitals labels (e.g. IdP group/department labels) scoped to a fleet/team never got any hosts. The membership cron only looked at global labels, and team-scoped IdP labels also failed to populate due to an incorrect SQL join.
Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85d05a46359c6cedfc876ea6646e86c46530a5e0253a4144310dc2f8f9b64055  fleet_v4.86.2_linux.tar.gz
f523b48ac462afbefec073a1f04f622bbc0b2b6263377be85d64b8feb5cc219b  fleetctl_v4.86.2_linux_amd64.tar.gz
e55e5d95c8c20b9be7e1b3d30bea077a37b1530440309ff068e9a13812d6e6be  fleetctl_v4.86.2_linux_amd64.zip
0c921a88d30de3679e903cacd8256d1905f0013438827f7569e7bf8cb301284b  fleetctl_v4.86.2_linux_arm64.tar.gz
406910bcc05ec7b6e4629717d5c990295388677ba2b432cb1d05d8cdd591d7ba  fleetctl_v4.86.2_linux_arm64.zip
d8ccd61b5765c8b4052c09c2b5ac832479bf296f77e8f2789cd6397c21d4375d  fleetctl_v4.86.2_macos.tar.gz
c97d41a5defcdebbc049fae4ddfa1b4167e6f39eb5eb5a45c29d39517c9c1187  fleetctl_v4.86.2_macos.zip
978ce2ef670afe9ed539426eb635331ca358f83ebebd3823225c530704b9302b  fleetctl_v4.86.2_windows_amd64.tar.gz
8c310d15fdc7264804b6d22a013fbe0bb09804799234668490840b00258f1004  fleetctl_v4.86.2_windows_amd64.zip
be8bab06e4ff592d7cd3a177ec2cb3487b4f0bf1da1d0afd4f49d7a9299b163e  fleetctl_v4.86.2_windows_arm64.tar.gz
b72948b6f18cf5a01ab5d95702b1d501350a60f9f8fe841a5b07cf9233dea278  fleetctl_v4.86.2_windows_arm64.zip

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Fleet device management

Get notified when new releases ship.

About Fleet device management

Open device management

All releases →

Related context

Related tools

Earlier breaking changes

vfleet-v4.86.0 Required `--host` flag for `fleetctl get mdm-commands`; deprecated `GET /api/v1/fleet/commands` without a `host_identifier`.
vfleet-v4.85.0 Enforced fleet name uniqueness across UI, API, and GitOps paths, returning 409 on conflicts