CVE-2026-111923 fleetdm CVE debrief

Who should care

Defenders responsible for Fleet deployments should assess exposure and prioritize upgrading to version 4.89.0 or later to prevent server crashes. IT teams and security personnel managing Fleet instances are advised to verify versions and monitor for unusual activity.

Why it matters

CVE-2026-111923 is a HIGH severity vulnerability in Fleet before 4.89.0 that allows unauthenticated attackers to crash servers. Defenders should prioritize verification, upgrades, and monitoring to prevent denial of service.

• Potential for server crashes leading to denial of service
• Need for verification of Fleet versions and exposure
• Priority for upgrading to version 4.89.0 or later
• Monitoring and inventory checks recommended

Technical summary

The vulnerability is caused by an unbounded recursion issue in Apple MDM enrollment property list parsing. An unauthenticated attacker can send a crafted binary plist payload to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory. This issue affects Fleet before version 4.89.0, and defenders should prioritize verifying Fleet versions and upgrading to prevent server crashes. Inventory checks and monitoring for unusual enrollment activity are recommended to detect potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying Fleet versions and upgrading to 4.89.0 or later to prevent server crashes. Inventory checks and monitoring for unusual enrollment activity are recommended.

Recommended defensive actions

• Verify Fleet version and upgrade to 4.89.0 or later
• Monitor enrollment activity for unusual patterns
• Perform inventory checks for vulnerable Fleet deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected deployments and potential mitigations is limited. Official sources indicate a fix in Fleet version 4.89.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.