CVE-2026-86934

CRITICALCVSS 9.1

Description

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

Timeline

Published:September 23rd, 2026 6:17 PM

Last modified:October 5th, 2026 6:17 PM

CVSS Scoring

CVSS v3: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Software

From NVD CPE configuration data

Vendors

claris

Products

filemaker_server

Weaknesses (CWE)

CWE-639

References & Reports

Advisories, patches, and third-party reports

https://support.claris.com/s/answerview?anum=000049217&language=en_USVendor Advisory

Source: NIST NVD · Data may lag official sources by up to one minute