M-Files Server EUVD-2026-30767

Exploitation requires network reachability to the M-Files Server MFserver endpoint and any valid authenticated M-Files user session (PR:L), with no user interaction and no elevated privileges needed. Exploitation is limited to environments running M-Files Server below 26.5.16015.0, 26.2 LTS, or 25.8 LTS SR3, and the attacker must already hold or obtain valid M-Files credentials - purely anonymous external attackers cannot trigger the crash. Impact is restricted to availability of the MFserver process; no data disclosure or modification is possible through this flaw.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H reflects a network-reachable, low-complexity, low-privilege attack with high availability impact and no confidentiality or integrity impact, yielding a base score of 7.1 - a meaningful operational risk but not catastrophic. EPSS data was not provided, the vulnerability is not listed in CISA KEV, and no POC has been published, so real-world exploitation pressure currently appears low. The primary risk is operational: any authenticated user - including low-privileged accounts in large M-Files tenants - can crash the server, which matters more in environments where M-Files is a critical document workflow dependency than where it is incidental. CVSS does not state whether the crash recovers automatically or requires manual restart; defenders should verify recovery behavior with M-Files support.

An attacker who has obtained or been issued any low-privileged M-Files user credential - for example a contractor, former employee with an unrevoked account, or a phished standard user - connects to M-Files Server over the network and sends a malformed but syntactically invalid request that the MFserver process fails to validate, terminating the service. Repeated triggering produces sustained denial of service against document workflows for all users until the service is restarted and the root cause patched. No public POC has been identified at time of analysis.