AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AppleCVE-2026-86934

Apple FileMaker Server: insecure direct object reference

Apple

CVE-2026-86934 · Published Sep 23, 2026 · updated Oct 5, 2026

Critical9.1
Fix: upgrade to 26.0.3 or later
Apple advisory

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

Affected versions

PackageAffectedFixed in
FileMaker Server
Product
< 26.0.326.0.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-639

More Apple advisories

All Apple
High 8.8Sep 28Apple iOS and iPadOS: out-of-bounds writeCVE-2026-86950fixed in 18.7.11 +2High 7.8Sep 23Apple FileMaker Server: buffer overflowCVE-2026-86926fixed in 26.0.3Critical 9.1Sep 23Apple FileMaker Server: out-of-bounds readCVE-2026-86930fixed in 26.0.3High 7.3Sep 23Apple FileMaker Pro: untrusted search pathCVE-2026-86938fixed in 26.0.3Medium 5.5Sep 14Apple macOS: path traversalCVE-2026-86902fixed in 14.8.8 +1Medium 5.5Sep 14Apple iOS and iPadOS: out-of-bounds readCVE-2026-86903fixed in 27 +2