CVE-2026-111923: Fleet MDM DOS Vulnerability

CVE-2026-111923 Overview

CVE-2026-111923 affects Fleet, an open-source device management platform, in versions prior to 4.89.0. The vulnerability resides in Apple Mobile Device Management (MDM) enrollment property list parsing logic. Unauthenticated attackers can submit a crafted binary plist payload of approximately 150 bytes to the enrollment endpoints. Parsing the payload triggers unbounded recursion and exponential allocation, exhausting CPU and memory on the Fleet server. The flaw is categorized under CWE-674: Uncontrolled Recursion and results in a denial-of-service condition against any internet-exposed Fleet instance.

Critical Impact

An unauthenticated remote attacker can crash a Fleet MDM server with a single ~150-byte binary plist, halting device management operations across the fleet.

Affected Products

• Fleet device management platform versions prior to 4.89.0
• Fleet deployments exposing Apple MDM enrollment endpoints to untrusted networks
• Any Fleet server handling Apple MDM device enrollment traffic

Discovery Timeline

• 2026-10-17 - CVE-2026-111923 published to the National Vulnerability Database
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111923

Vulnerability Analysis

Fleet parses Apple MDM enrollment data submitted as Apple binary property lists (bplist00). The parser recursively walks nested container objects (dictionaries and arrays) without enforcing a maximum nesting depth or object graph size. An attacker crafts a compact binary plist whose object table references nested or self-referential containers. Decoding this payload drives either runaway recursion or exponential memory allocation.

The enrollment endpoints accept these payloads without prior authentication, so no credentials, device certificate, or prior enrollment context is required. A payload of roughly 150 bytes is sufficient to saturate CPU and exhaust process memory, forcing the Fleet process to crash or become unresponsive. Repeated requests sustain the outage.

Root Cause

The root cause is missing recursion depth limits and missing object graph size validation in the binary plist decoder path used by the Apple MDM enrollment handler. Because the parser trusts the attacker-controlled object references, the decoder expands cyclic or deeply nested structures until stack or heap resources are depleted. This is a textbook instance of CWE-674.

Attack Vector

The vector is network-based and requires no authentication or user interaction. The attacker issues an HTTPS POST to a public Apple MDM enrollment endpoint on the Fleet server, delivering the malformed bplist00 payload with an appropriate content type. The server-side plist decoder begins parsing, enters uncontrolled recursion, and consumes CPU and memory until the process terminates or the host becomes unresponsive. No sample exploitation code is published in the referenced advisories; see the GitHub Security Advisory GHSA-x467-vgxf-2g6h and the VulnCheck Advisory for Fleet 4.89.0 for parser-level details.

// No verified proof-of-concept code is published. Refer to vendor advisories
// for parser internals and payload structure.

Detection Methods for CVE-2026-111923

Indicators of Compromise

• Fleet server processes terminating with out-of-memory errors or stack overflow signals shortly after receiving MDM enrollment traffic.
• Short, repeated HTTPS POST requests to Apple MDM enrollment endpoints with Content-Type: application/x-apple-aspen-mdm or similar plist content types from unexpected source IPs.
• Sudden CPU saturation and resident memory spikes on Fleet hosts without a corresponding increase in legitimate enrollment volume.
• Request bodies on enrollment paths that begin with the bplist00 magic header and are under a few hundred bytes.

Detection Strategies

• Alert on Fleet process restarts, crash loops, or systemd service failures correlated with inbound MDM enrollment requests.
• Inspect reverse proxy and load balancer logs for small-body POSTs to MDM endpoints followed by 5xx responses or dropped connections.
• Deploy web application firewall rules that flag binary plist payloads with abnormal nesting depth or self-referential object tables.

Monitoring Recommendations

• Continuously monitor Fleet server CPU, memory, and process uptime, and page on anomalous resource exhaustion events.
• Track request rate, source IP distribution, and payload size on Apple MDM enrollment endpoints to baseline normal behavior.
• Forward Fleet application logs and host telemetry to a centralized analytics platform to correlate parser errors with request metadata.

How to Mitigate CVE-2026-111923

Immediate Actions Required

• Upgrade Fleet to version 4.89.0 or later on every server handling MDM enrollment traffic.
• Restrict network exposure of MDM enrollment endpoints to known enrollment sources where feasible, using firewall rules or reverse proxy allow lists.
• Enable rate limiting on enrollment endpoints at the load balancer or web application firewall layer to blunt crash-loop attempts.
• Review inbound logs for the past 30 days for small binary plist POSTs that correlate with Fleet instability.

Patch Information

Fleet version 4.89.0 resolves CVE-2026-111923 by hardening the Apple MDM enrollment plist parser. Operators should consult the GitHub Security Advisory GHSA-x467-vgxf-2g6h for the authoritative fixed version, upgrade notes, and release artifacts. The VulnCheck Advisory for Fleet 4.89.0 provides supplemental context.

Workarounds

• Place a reverse proxy or WAF in front of Fleet and enforce a strict maximum request body size on MDM enrollment paths.
• Drop or quarantine requests whose bodies begin with bplist00 and exceed a configured nesting depth, using a plist-aware filter.
• Isolate the Fleet server behind a VPN or private network segment until the upgrade to 4.89.0 is deployed.

# Example reverse proxy guardrail (illustrative) — reject tiny plist POSTs
# to MDM enrollment paths from untrusted sources until patched.
location ~ ^/mdm/apple/(enroll|scep|mdm)$ {
    client_max_body_size 64k;
    limit_req zone=mdm_enroll burst=5 nodelay;
    proxy_pass http://fleet_upstream;
}