CVE-2026-86934: claris filemaker_server

CVSS 9.1 (critical) · published 2026-09-23

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

Affected products (NVD): claris filemaker_server

Fixed in (NVD): 26.0.3

Weakness: CWE-639

Source: NVD CVE-2026-86934

References

• https://support.claris.com/s/answerview?anum=000049217&language=en_US

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.