CVE-2026-23518: Critical JWT Signature Bypass in Fleet Windows MDM

CVE-2026-23518 is a critical flaw (CVSS 9.8) in Fleet device management. In the Windows MDM enrollment flow, JWT signatures were not verified, so forged tokens could enroll unauthorized devices under any Azure AD user identity. Fixed versions are 4.78.3, 4.77.1, 4.76.2, 4.75.2 and 4.53.3.

What's affected

The GitHub advisory lists Fleet versions up to 4.78.2 as affected, and the record names five fixed releases, one per supported line:

• 4.78.3
• 4.77.1
• 4.76.2
• 4.75.2
• 4.53.3

The risk applies when Windows MDM is enabled. If you do not use Windows MDM enrollment, the advisory's impact statement does not apply to you, though you should still upgrade.

If an immediate upgrade is not possible, the advisory says to temporarily disable Windows MDM.

How to check if you're exposed

Check the Fleet server version and whether Windows MDM is turned on:

fleet version

In the Fleet console, the MDM settings page shows whether Windows MDM is enabled. Compare your version with the fixed release for your line. Then review recent Windows enrollments for devices you do not recognize, especially ones tied to user identities that have no reason to be enrolling.

What to do now

1. Upgrade to the fixed release in your line: 4.78.3, 4.77.1, 4.76.2, 4.75.2 or 4.53.3.
2. If you cannot upgrade today, disable Windows MDM temporarily, as the advisory describes.
3. Review the list of enrolled Windows hosts and remove any you cannot account for.
4. Check which identities the unknown hosts claim and review those accounts.
5. Keep Fleet in your dependency and release monitoring.

Why it matters

The record lists CWE-347 (Improper Verification of Cryptographic Signature). The server read identity claims from a token without checking the signature that proves who issued it. A JWT is only as trustworthy as its signature, so skipping that check means anyone can write their own token and claim any identity.

For a device management system the consequence is serious. An enrolled device can receive policy and can be trusted by other systems, so a rogue device enrolled under a real user's name can blend in. The same bug pattern appears across many products that handle tokens: verify the signature, the issuer, the audience and the expiry, every time. The record does not mark this CVE as exploited in the wild.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub advisory GHSA-63m5-974w-448v

Last reviewed: 19 October 2026.