CVE-2026-86930: claris filemaker_server

CVSS 9.1 (critical) · published 2026-09-23

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3.

Affected products (NVD): claris filemaker_server

Fixed in (NVD): 26.0.3

Weakness: CWE-125

Source: NVD CVE-2026-86930

References

• https://support.claris.com/s/answerview?anum=000049218&language=en_US

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.