CVE-2026-114611 - OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack
CVE ID :CVE-2026-114611 Published : Oct. 22, 2026, 5:33 p.m. | 34 minutes ago Description :OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint...