CVE-2026-43752

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-10-25
Weakness: CWE-434

Description

An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Admin Console. This vulnerability has been addressed in FileMaker Server 26.0.1.

Affected products

Claris FileMaker Server: before 26.0.1 — fixed in 26.0.1

How to fix

Upgrade to a fixed version: Claris FileMaker Server 26.0.1. Check the vendor advisory for mitigations.

References

https://community.claris.com/en/s/article/Arbitrary-Code-Execution-Vulnerability-Addressed-in-FileMaker-Server-via-Miniforge-Installer-Upload

Get alerted when CVE-2026-43752 or the next vulnerability affects your stack