Fleetdm/Fleet/V4 — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fleetdm/fleet/v4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 14 May 2026 13:15:33 +0000Fleet Windows MDM Azure AD JWT Authentication Bypass Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-05-fleet-jwt-bypass/Thu, 14 May 2026 13:15:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-fleet-jwt-bypass/A vulnerability in Fleet versions prior to 4.82.0 allows authentication tokens from any Azure AD tenant to be accepted, enabling unauthorized device enrollment and MDM API access due to improper JWT signature validation, tracked as CVE-2026-24899.A critical vulnerability exists in Fleet versions prior to 4.82.0, specifically affecting the Windows MDM enrollment flow. This flaw stems from insufficient validation of JWT signatures during the Azure AD authentication process. Fleet’s implementation utilizes Microsoft’s multi-tenant JWKS endpoint for signature verification but neglects to enforce the aud (audience) and iss (issuer) claims within the JWT. This oversight permits the acceptance of authentication tokens originating from any Azure AD tenant, as long as they are signed by Microsoft and contain the expected scopes. Successful exploitation allows attackers to bypass intended authorization controls, enabling them to enroll unauthorized devices and interact with Fleet’s MDM management APIs, potentially exposing enrollment secrets.

Attack Chain

  1. Attacker gains access to any Azure AD tenant, potentially through compromised credentials or a rogue application registration.
  2. The attacker requests an Azure AD access token with the necessary scopes for Fleet MDM enrollment.
  3. The attacker initiates the Windows MDM enrollment process, presenting the crafted Azure AD access token to the Fleet MDM endpoint.
  4. Fleet validates the JWT signature against Microsoft’s JWKS endpoint but skips validation of the aud and iss claims.
  5. The unauthorized access token is accepted by Fleet, granting the attacker the ability to enroll a device under a different Azure AD tenant.
  6. The attacker leverages enrolled devices to interact with Fleet’s MDM management APIs.
  7. Sensitive enrollment secrets embedded in MDM command payloads are exposed to the attacker.
  8. The attacker uses exposed secrets for further unauthorized access or lateral movement within the environment.

Impact

Successful exploitation of CVE-2026-24899 can lead to unauthorized device enrollment, potentially giving attackers control over managed Windows systems. Fleet may expose sensitive enrollment secrets, facilitating further unauthorized access. This vulnerability has the potential to affect any organization using Fleet with Windows MDM enabled, leading to data breaches and compromised systems.

Recommendation

  • Immediately upgrade Fleet to version 4.82.0 or later to address the vulnerability (reference: Affected Packages).
  • As an immediate workaround, disable Windows MDM in Fleet if an upgrade is not possible (reference: Workarounds).
  • Monitor Fleet logs for suspicious device enrollment activities originating from unexpected Azure AD tenants (requires specific logging not detailed in source).
  • Investigate any unauthorized device enrollments identified within the Fleet management console (requires manual review).
]]>highthreatjwtazureadauthenticationbypassmdmfleetdm