What’s Vulnerable › Vulnerabilities
CVE-2026-86934
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-10-05
- Weakness: CWE-639
Description
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.
Affected products
- Claris FileMaker Server: before 26.0.3 — fixed in 26.0.3
How to fix
Upgrade to a fixed version: Claris FileMaker Server 26.0.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86934 or the next vulnerability affects your stack