AppleCVE-2026-86938

Apple FileMaker Pro: untrusted search path

CVE-2026-86938 · Published Sep 23, 2026 · updated Oct 5, 2026

High7.3

Fix: upgrade to 26.0.3 or later

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3.

Affected versions

Package	Affected	Fixed in
FileMaker Pro Product	< 26.0.3	26.0.3

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-639

More Apple advisories

All Apple

High 8.8Sep 28

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-86950fixed in 18.7.11 +2 High 7.8Sep 23

Apple FileMaker Server: buffer overflowCVE-2026-86926fixed in 26.0.3 Critical 9.1Sep 23

Apple FileMaker Server: out-of-bounds readCVE-2026-86930fixed in 26.0.3 Critical 9.1Sep 23

Apple FileMaker Server: insecure direct object referenceCVE-2026-86934fixed in 26.0.3 Medium 5.5Sep 14

Apple macOS: path traversalCVE-2026-86902fixed in 14.8.8 +1 Medium 5.5Sep 14

Apple iOS and iPadOS: out-of-bounds readCVE-2026-86903fixed in 27 +2