CVE-2026-2039CWE-862

GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability

High · published February 20, 2026

CVSS v3.0
7.3
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the MArc.Store.Remoting.exe process, which listens on port 8018. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-28597.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00743 · 54.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-20T22:13Z
EPSS history
Timeline
  • 20 FEB 22:13Z
    GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability
    cvelistv5