CVE-2025-11681: Denial of Service condition in M-Files Server

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-17 · updated 2026-10-07
Weakness: CWE-400

Description

Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash.

Affected products

M-Files Corporation M-Files Server: before 25.2.14524.13; before 25.11.15392.1; from 25.8.15085.13 before 25.8.15085.17 — fixed in 25.11.15392.1, 25.2.14524.13, 25.8.15085.17

How to fix

Upgrade to a fixed version: M-Files Corporation M-Files Server 25.11.15392.1, 25.2.14524.13, 25.8.15085.17. Check the vendor advisory for mitigations.

References

https://empower.m-files.com/security-advisories/CVE-2025-11681
https://product.m-files.com/security-advisories/cve-2025-11681/

Get alerted when CVE-2025-11681 or the next vulnerability affects your stack