Skip to main content

M-Files Server EUVDEUVD-2026-53296

| CVE-2026-0931 MEDIUM
Improper Validation of Syntactic Correctness of Input (CWE-1286)
2026-08-05 security@m-files.com GHSA-rf5m-j276-h6pq
Denial Of Service
6.9
CVSS 4.0 · Vendor: m-files
Share

Severity by source

Vendor (m-files) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.9 MEDIUM

Admin authentication required (PR:H); network-reachable with low complexity; no confidentiality or integrity impact; scope unchanged as only the crashing server process is affected.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (m-files).

CVSS VectorVendor: m-files

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Aug 05, 2026 - 11:02 EUVD
Analysis Generated
Aug 05, 2026 - 10:31 vuln.today

DescriptionCVE.org

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart.

AnalysisAI

M-Files Server before version 26.5.16015.3 can be crashed and permanently halted by an authenticated administrator, requiring manual intervention to restore document management services. The vulnerability stems from improper validation of syntactic input correctness (CWE-1286), allowing a privileged user to trigger a process crash from which the server cannot automatically recover. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid admin credentials via phishing or compromise
Delivery
Authenticate to M-Files Server over network
Exploit
Submit syntactically malformed input to vulnerable handler
Execution
CWE-1286 validation bypass triggers unhandled exception
Persist
Server process crashes and fails to auto-restart
Impact
Document management services offline pending manual recovery
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid M-Files Server administrator account - confirmed by PR:H in the CVSS 4.0 vector, meaning unauthenticated external attackers cannot trigger this vulnerability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 (Medium) is an accurate reflection of real-world risk given the PR:H constraint - exploitation requires a valid administrative account, which substantially limits the attacker population to insiders, compromised admin sessions, or supply-chain-adjacent threats. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An administrator with valid credentials - whether a malicious insider, an operator whose account has been phished, or an automated process with admin rights - connects to M-Files Server over the network and submits a syntactically malformed request to the vulnerable input-handling path. The server process crashes and fails to reinitialize automatically, taking all document management operations offline until a system administrator manually intervenes to restart the service. …
Remediation Upgrade M-Files Server to version 26.5.16015.3 or later, which resolves this vulnerability per the vendor security advisory at https://empower.m-files.com/security-advisories/CVE-2026-0931. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-1286 – Improper Validation of Syntactic Correctness of Input

View all
CVE-2024-6284 MEDIUM POC
6.3
CVE-2025-10954 MEDIUM POC
5.5
CVE-2024-6763 MEDIUM POC
5.3
CVE-2021-31988 HIGH
8.8
CVE-2026-57026 HIGH
8.7
CVE-2026-33778 HIGH
8.7
CVE-2025-8873 HIGH
8.7
CVE-2024-39542 HIGH
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-53296 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy