CVE-2026-86934CWE-639

CVE-2026-86934

Critical · published September 23, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-23T22:17Z
Affected products (1)
ProductVersionsFixed in
claris/filemaker_server< 26.0.326.0.3
References (1)
https://support.claris.com/s/answerview?anum=000049217&language=en_US · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 17:20Z
    An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the…
    cvelistv5