CVE Feed

    Dashboard / CVE / CVE-2026-86930

    CVE-2026-86930

    An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3.

    Published:Sep 23, 2026
    Last Modified:Oct 5, 2026
    EPS:Sep 23, 2026
    EPSS Score:0.0029
    CVSS Score:9.1

    Affected Products

    Vendor
    Claris
    Product
    Filemaker Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-86934 (CVSS 9.1) — An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containin…
    CVE-2026-86926 (CVSS 7.8) — A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a m…
    CVE-2026-43752 (CVSS 4.9) — An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading…
    CVE-2025-46320 (CVSS 6.1) — A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized…
    CVE-2025-46296 (CVSS 5.4) — An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minim…
    CVE-2025-46295 (CVSS 9.8) — Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applica…
    CVE-2025-46294 (CVSS 5.3) — To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filenam…
    CVE-2024-27790 (CVSS 7.5) — Claris International has resolved an issue of potentially allowing unauthorized access to records stored in da…
    CVE-2023-42955 (CVSS 4.9) — Claris International has successfully resolved an issue of potentially exposing password information to front-…
    CVE-2024-27794 (CVSS 6.1) — Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerabilit…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High