Key points
- Fleet versions before 4.89.0 contain a high-severity vulnerability.
- Attackers need no credentials to trigger the flaw.
- A crafted binary plist payload of about 150 bytes causes the crash.
Fleet versions prior to 4.89.0 are affected by a high-severity vulnerability tracked as CVE-2026-111923. The flaw allows unauthenticated attackers to crash the server by sending a small, crafted payload. This issue impacts the Apple MDM enrollment property list parsing component. No fix has been confirmed yet in the source material provided.
In plain English
The vulnerability exists in how Fleet processes specific configuration files during Apple device enrollment. An attacker can send a binary plist payload of approximately 150 bytes to the enrollment endpoints. This tiny input triggers exponential memory allocation or infinite recursion within the server. The result is that the server exhausts its CPU and memory resources, leading to a crash.
The background
The National Vulnerability Database records this issue with a CVSS score of 8.7, which is rated as high severity. The weakness is classified under CWE-674, which relates to uncontrolled resource consumption. The flaw specifically targets the parsing logic for Apple MDM enrollment property lists. Because the attack requires no authentication, any user on the internet can attempt to exploit it if the endpoints are exposed.
What changes now
Organizations running Fleet versions older than 4.89.0 are at risk of service interruption. The vulnerability allows remote attackers to cause a denial of service by crashing the server. Since no patch has been confirmed in the provided material, administrators must assess their current exposure. They should verify which version of Fleet is installed and whether the enrollment endpoints are accessible from the public internet.
Who needs to act first
Teams usually prioritize systems that face the internet without additional access controls. Check whether your enrollment endpoints are publicly reachable and restrict access if possible. Back up your current configuration before making any changes to your environment. Test any mitigation steps in a non-production setting first to ensure they do not break legitimate enrollment workflows. Monitor server logs for unusual resource spikes that might indicate an ongoing attack attempt.
What to do and how to stay safe: Fleet
- Verify the version of Fleet installed on your servers to confirm if it is before 4.89.0.
- Restrict network access to enrollment endpoints to prevent unauthenticated requests from the internet.
- Monitor server CPU and memory usage for sudden spikes that could indicate exploitation attempts.
- Once the vendor provides an update, apply the patch promptly to resolve the recursion vulnerability.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111923?
The CVSS score is 8.7, which is rated as high severity.
Does an attacker need a login to exploit this flaw?
No, the vulnerability allows unauthenticated attackers to crash the server.
What kind of payload triggers the crash?
A crafted binary plist payload of about 150 bytes triggers the issue.
