CVE-2026-86926: Claris Filemaker Server

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed in FileMaker Server version 26.0.3.

Affected products

• Claris Filemaker Server: before 26.0.3 (fixed in 26.0.3)

Published 2026-09-23. Last modified 2026-10-06.