CVE-2026-86934: Claris FileMaker Server vulnerability

Q: Which deployments are exposed to this issue?

FileMaker Server deployments using the Web Publishing Engine and XML Web Publishing interface are relevant. The bypass specifically defeats the disabled Custom Web Publishing with XML setting.

Q: What does an attacker need to exploit the bypass?

The vulnerable request must contain an extended privilege header. The provided information does not state any additional authentication, network-access, or privilege requirements.

Q: What version fixes the issue?

Claris addressed the vulnerability in FileMaker Server version 26.0.3.

Published Sep 23, 2026

Updated

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

Affected Software

1 affected component

Claris FileMaker Server<26.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FileMaker Server to a version that resolves this vulnerability.
Fixed in 26.0.3

Event History

Sep 23, 2026

CVE Published

via MITRE·05:20 PM

Data Sourced

via MITRE·05:20 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

FileMaker Server deployments using the Web Publishing Engine and XML Web Publishing interface are relevant. The bypass specifically defeats the disabled Custom Web Publishing with XML setting.

What does an attacker need to exploit the bypass?

The vulnerable request must contain an extended privilege header. The provided information does not state any additional authentication, network-access, or privilege requirements.

What version fixes the issue?