Skip to content
CVE-2026-111923: Unbounded Recursion Vulnerability in Fleet's Apple MDM Enrollment

CVE-2026-111923: Unbounded Recursion Vulnerability in Fleet's Apple MDM Enrollment

First seen 18 Oct 2026, 00:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 02:09 UTC
  • •CVE-2026-111923 affects Fleet versions before 4.89.0.
  • •Attackers can exploit the vulnerability to crash the server via crafted payloads.
  • •Organizations should upgrade to the fixed version or restrict access to vulnerable endpoints.

CVE-2026-111923, disclosed on 2026-10-17, identifies an unbounded recursion vulnerability in Fleet's Apple MDM enrollment property list parsing. This flaw allows unauthenticated attackers to crash the server by sending a crafted 150-byte binary plist payload to the enrollment endpoints. The vulnerability affects versions prior to 4.89.0 and poses a service-availability risk without direct confidentiality or integrity impacts. Organizations with self-hosted or internet-accessible fleet-management services using Apple MDM are most at risk. Fleet has released version 4.89.0 to address this issue, which bounds the depth and size of parsed property lists. Until upgrades can be applied, restricting access to the enrollment endpoints is recommended. No active exploitation has been reported, but the potential for denial of service exists.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
CVE-2026-111923 published
The vulnerability was disclosed, allowing unauthenticated attackers to crash Fleet servers with Apple MDM enabled.
Redpacketsecurity
2026-10-18
Advisory released by GitHub
GitHub published an advisory detailing the vulnerability and recommended mitigations for affected users.
github.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-111923 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 2

Common questions

What versions of Fleet are affected?
Fleet versions prior to 4.89.0 are vulnerable to CVE-2026-111923.
What should I do if I can't upgrade immediately?
Restrict access to the Apple MDM enrollment endpoints to trusted networks until an upgrade can be applied.
Is there any active exploitation of this vulnerability?
No active exploitation has been reported as of now.