Which versions of M-Files Server are affected by CVE-2026-0983?

M-Files Server contains a vulnerability that could crash the document management service, preventing all users from accessing critical documents and disrupting document-dependent business processes.. A patch is available.

How to fix or mitigate CVE-2026-0983?

Within 24 hours: Inventory all M-Files Server deployments and record current versions; no public exploit has been identified, but assess the number of affected users and criticality of stored documents. Within 7 days: Restrict M-Files Server access to essential business users and administrators only; implement monitoring and alerting for unexpected MFserver process failures. Within 30 days: Monitor M-Files vendor security advisories for patches; develop and test upgrade procedures for versions 26.5.16015.0, 26.2 LTS, and 25.8 LTS SR3.

M-Files Server CVE-2026-0983

Q: What is the CVSS score of CVE-2026-0983?

CVE-2026-0983 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30767 HIGH

Improper Validation of Syntactic Correctness of Input (CWE-1286)

2026-05-18 M-Files Corporation

GHSA-x6cg-7p5m-7wcc

Denial Of Service M Files Server

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 18, 2026 - 13:01 EUVD

Analysis Generated

May 18, 2026 - 12:30 vuln.today

CVSS changed

May 18, 2026 - 12:22 NVD

7.1 (HIGH)

DescriptionCVE.org

Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash

AnalysisAI

Denial of service in M-Files Server versions prior to 26.5.16015.0, 26.2 LTS, and 25.8 LTS SR3 allows an authenticated remote attacker to crash the MFserver process, disrupting document management services for all connected users. The flaw is reachable over the network with low privileges and no user interaction, but has no impact on confidentiality or integrity. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.

Technical ContextAI

M-Files Server is the backend service of M-Files Corporation's enterprise document management and information governance platform, exposing the MFserver process to authenticated client connections. The weakness is classified as CWE-1286 (Improper Validation of Syntactic Correctness of Input), indicating that the server fails to properly validate the structural correctness of input it receives from authenticated clients, leading the MFserver process to terminate unexpectedly. The affected CPE cpe:2.3:a:m-files_corporation:m-files_server covers all M-Files Server installations below the listed fixed builds across the current, 26.2 LTS, and 25.8 LTS release trains.

RemediationAI

Vendor-released patch: upgrade M-Files Server to 26.5.16015.0 or later on the current train, to 26.2 LTS, or to 25.8 LTS SR3 depending on the deployed release line, as published in the M-Files advisory at https://empower.m-files.com/security-advisories/CVE-2026-0983. Until patching is possible, restrict M-Files Server access to trusted networks and reduce the population of accounts that can authenticate to the server - for example by tightening AD group membership for M-Files logins and disabling unused or test accounts - accepting that this will block legitimate remote or contractor access and is only a partial mitigation since any retained authenticated user can still trigger the crash. Operationally, ensure the MFserver process is supervised so that an induced crash auto-restarts (via the Windows service recovery settings) and monitor for repeated unexpected service stops as a detection signal.