PatchTheCVECVE-2026-86934: An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containin
CVE-2026-86934 is a critical-severity flaw (CVSS 9.1) affecting filemaker server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 76%) |
| CISA exploited list | No |
| Weakness | CWE-639 |
| Published | 2026-09-23 |
| Last modified | 2026-10-05 |
Last updated 2026-10-05 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-86934?
filemaker server: upgrade to 26.0.3. Exact commands for each OS are on this page.
Is CVE-2026-86934 being exploited?
CVE-2026-86934 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-86934 affect?
CVE-2026-86934 affects filemaker server. Severity is critical (CVSS 9.1). An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing int
How urgent is CVE-2026-86934?
Priority 43/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-43752 MEDIUM 4.9 UPGRADE An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading
- CVE-2026-86926 HIGH 7.8 UPGRADE A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a m
- CVE-2026-86930 CRITICAL 9.1 UPGRADE An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially cr