CVE-2026-0663: M-Files Server

Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the M-Files Server process by calling a vulnerable API endpoint.

Affected products

• M-Files M-Files Server: before 26.1.15632.3 (fixed in 26.1.15632.3)

Published 2026-01-21. Last modified 2026-06-17.