CVE-2026-86930: Claris Filemaker Server

Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3.

Affected products

• Claris Filemaker Server: before 26.0.3 (fixed in 26.0.3)

Published 2026-09-23. Last modified 2026-10-05.