Is CVE-2026-111923 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111923 being exploited in the wild.

How severe is CVE-2026-111923?

High severity, with a CVSS score of 7.5, published 17 October 2026.

Which products and versions are affected?

Fleet Device Management Fleet before 4.89.0.

How is CVE-2026-111923 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-111923?

Check whether you run Fleet Device Management Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111923: Fleet unbounded recursion in Apple MDM enrollment property list parsing

CVE-2026-111923 · Severity: high · CVSS 7.5 · Published 2026-10-17

Fleet is a device management server used to enroll and manage iOS and Mac devices. An unauthenticated attacker can send a small malicious file to Fleet's device enrollment endpoints to trigger uncontrolled recursion, crashing the server and making it unavailable to all users. This denial-of-service attack requires only network access and no authentication.

Technologies: Fleet Device Management Fleet. Vendors: Fleet Device Management.

Quick answers

Is CVE-2026-111923 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111923 being exploited in the wild.
How severe is CVE-2026-111923?: High severity, with a CVSS score of 7.5, published 17 October 2026.
Which products and versions are affected?: Fleet Device Management Fleet before 4.89.0.
Is there a fix for CVE-2026-111923?: Yes: fixed in Fleet 4.89.0 (or later 4.92.0). Until then: If upgrading immediately is not possible, restrict network access to the Apple MDM enrollment endpoints (/api/mdm/apple/enroll and /api/mdm/apple/account_driven_enroll) to trusted networks only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111923 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-111923?: Check whether you run Fleet Device Management Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fleet 4.89.0 (or later 4.92.0)

If upgrading immediately is not possible, restrict network access to the Apple MDM enrollment endpoints (/api/mdm/apple/enroll and /api/mdm/apple/account_driven_enroll) to trusted networks only.

Technical details

Fleet's Apple MDM enrollment endpoints parse binary property lists from unauthenticated clients with no recursion depth or cycle limits, leading to CWE-674 (uncontrolled recursion). A roughly 150-byte crafted plist payload can force exponential memory allocation or infinite recursion, exhausting CPU and memory. The vulnerability exists in the pre-authentication enrollment flow and is fixed by bounding plist depth and size in affected versions.

Affected products

Fleet Device Management Fleet before 4.89.0

Timeline

2026-10-02: disclosed
2026-10-17: advisory
2026-10-02: patched: Fleet 4.89.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.