CVE-2026-23518CWE-347

Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

Critical · published January 21, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00254 · 16.0th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-01-21T21:50Z
EPSS history
Timeline
  • 21 JAN 21:50Z
    Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
    cvelistv5