High severity · published Oct 17, 2026
CVE-2026-111923
Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
fleet · fleetdm
before 4.89.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111923
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111923
github.com
https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h
www.vulncheck.com
https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing
More from fleet
9.8
CVE-2026-26191
Fleet vulnerable to OS command injection in software packages
9.8
CVE-2026-34387
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
9.8
CVE-2026-23518
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
9.8
CVE-2020-26276
Fleet is an open source osquery manager
9.3
CVE-2025-27509
SAML authentication vulnerability due to improper SAML response validation