FileMaker Server CVE-2026-86934

Requires an internet- or network-reachable FileMaker Server running the Web Publishing Engine with the Custom Web Publishing with XML setting explicitly disabled - the flaw specifically defeats that disabled state via an extended privilege header, so the WPE component must be deployed and the XML publishing path must be the intended-off configuration the operator relied upon. Exploitation is unauthenticated (PR:N) and needs no user interaction, but is limited to deployments actually exposing the Web Publishing Engine; environments not using Web Publishing at all are unaffected, and versions 26.0.3 and later are patched.

This is a serious, network-reachable authorization bypass but the exploitation signals are mixed. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes unauthenticated remote exploitation with high confidentiality and integrity impact, and SSVC corroborates severity with Technical Impact 'total' and Automatable 'yes' - meaning the bypass can be scripted at scale. However, SSVC Exploitation is 'none', EPSS is only 0.15% (3rd percentile), there is no CISA KEV listing, and no public exploit code was identified, so real-world exploitation is currently theoretical rather than observed. The high automatability plus the reporter being Apple (Claris's parent) suggests a well-characterized, credible flaw that could be reverse-engineered from the 26.0.3 patch, so it merits prompt patching even though it is not yet under active exploitation. Note one nuance to verify with the vendor: CWE-639 and the description frame this as an *authorization* bypass of a *disabled* feature (Custom Web Publishing with XML), so C:H/I:H assumes the exposed XML Web Publishing interface yields meaningful database read/write; whether full data access still requires valid database account credentials behind the extended-privilege header is not fully clear from the description.

A remote unauthenticated attacker sends an HTTP request to a FileMaker Server whose administrator has deliberately disabled Custom Web Publishing with XML, including a crafted extended privilege header that the Web Publishing Engine wrongly honors. This re-enables access to the XML Web Publishing interface, letting the attacker query and manipulate hosted database data through an interface the operator believed was turned off. No public proof-of-concept exists at time of analysis, but SSVC rates the technical impact 'total' and automatable.