# CVE-2026-111923: Fleet unbounded recursion in Apple MDM enrollment property list parsing

Source: https://junglewise.ai/threats/cve-2026-111923-fleet-before-4-89-0-contains-an-unbounded-recursion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111923 · Severity: high · CVSS 7.5 · Published 2026-10-17

Fleet is a device management server used to enroll and manage iOS and Mac devices. An unauthenticated attacker can send a small malicious file to Fleet's device enrollment endpoints to trigger uncontrolled recursion, crashing the server and making it unavailable to all users. This denial-of-service attack requires only network access and no authentication.

Technologies: [Fleet Device Management Fleet](https://junglewise.ai/threats/technologies/fleet-device-management-fleet). Vendors: [Fleet Device Management](https://junglewise.ai/threats/vendors/fleet-device-management).

## Quick answers

**Is CVE-2026-111923 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111923 being exploited in the wild.

**How severe is CVE-2026-111923?** High severity, with a CVSS score of 7.5, published 17 October 2026.

**Which products and versions are affected?** Fleet Device Management Fleet before 4.89.0.

**Is there a fix for CVE-2026-111923?** Yes: fixed in Fleet 4.89.0 (or later 4.92.0). Until then: If upgrading immediately is not possible, restrict network access to the Apple MDM enrollment endpoints (/api/mdm/apple/enroll and /api/mdm/apple/account_driven_enroll) to trusted networks only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111923 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-111923?** Check whether you run Fleet Device Management Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fleet 4.89.0 (or later 4.92.0)

If upgrading immediately is not possible, restrict network access to the Apple MDM enrollment endpoints (/api/mdm/apple/enroll and /api/mdm/apple/account_driven_enroll) to trusted networks only.

## Technical details

Fleet's Apple MDM enrollment endpoints parse binary property lists from unauthenticated clients with no recursion depth or cycle limits, leading to CWE-674 (uncontrolled recursion). A roughly 150-byte crafted plist payload can force exponential memory allocation or infinite recursion, exhausting CPU and memory. The vulnerability exists in the pre-authentication enrollment flow and is fixed by bounding plist depth and size in affected versions.

## Affected products

- Fleet Device Management Fleet before 4.89.0

## Timeline

- 2026-10-02: disclosed
- 2026-10-17: advisory
- 2026-10-02: patched: Fleet 4.89.0 released with fix

## References

- [https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h](https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h)
- [https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing](https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing)

## Related threats

- [Fleet device API authentication bypass via non-secret identifiers](https://junglewise.ai/threats/cve-2026-103264-fleet-versions-before-4-87-0-contain-an-authentication-bypass)
- [Fleet missing authorization on iOS app package endpoints](https://junglewise.ai/threats/cve-2026-101047-fleet-before-4-87-0-does-not-protect-the-two-endpoints-that)