Unrated severityNVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026

CVE-2026-86934

Description

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

Affected products

Filemaker/Filemaker Serverllm-fuzzy
Range: >=26.0.3
Claris/Filemaker Serverllm-fuzzy
Range: >=26.0.3

Patches

Vulnerability mechanics

References

support.claris.com/s/answerviewnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000