CVE-2026-43685: Claris FileMaker Cloud RCE Vulnerability

CVE-2026-43685 Overview

CVE-2026-43685 is an OS command injection vulnerability in Claris FileMaker Cloud. The flaw resides in the External ODBC Data Source connection test feature exposed through the Admin Console. An authenticated administrator can inject arbitrary operating system commands through unsanitized input fields, leading to remote code execution on the host. Claris addressed the issue in FileMaker Cloud 2.22.0.5. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact

An attacker with Admin Console privileges can execute arbitrary OS commands on the FileMaker Cloud host, fully compromising confidentiality, integrity, and availability of the database environment.

Affected Products

• Claris FileMaker Cloud versions prior to 2.22.0.5
• Deployments exposing the Admin Console over the network
• External ODBC Data Source connection test functionality

Discovery Timeline

• 2026-05-12 - CVE-2026-43685 published to the National Vulnerability Database
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-43685

Vulnerability Analysis

The vulnerability is an OS command injection ([CWE-78]) in the External ODBC Data Source connection test feature of the Claris FileMaker Cloud Admin Console. The connection test routine passes user-supplied parameters into an underlying operating system command without proper sanitization or escaping. An authenticated administrator can embed shell metacharacters within ODBC connection fields to break out of the intended command context and execute arbitrary commands. The EPSS score is 0.232% with a percentile of 45.91, indicating low public exploitation likelihood at this time.

Root Cause

The defect stems from the connection test handler concatenating untrusted input directly into a shell command string. The implementation does not enforce an allow-list of valid ODBC parameter values and does not use parameterized process execution APIs. As a result, characters such as ;, &&, |, and backticks pass through to the system shell.

Attack Vector

Exploitation requires Admin Console credentials and network reachability to the FileMaker Cloud management interface. The attacker submits a crafted ODBC connection configuration and triggers the connection test action. The injected payload runs in the security context of the FileMaker Cloud service account. This grants the attacker direct command execution on the host operating system. Refer to the Claris Support Article for vendor-provided technical context.

Detection Methods for CVE-2026-43685

Indicators of Compromise

• Unexpected child processes spawned by the FileMaker Cloud Admin Console or ODBC connection-test service.
• Shell metacharacters such as ;, |, &&, or backticks present in ODBC Data Source configuration fields within audit logs.
• Outbound network connections initiated by the FileMaker Cloud service to untrusted hosts following a connection-test event.
• New or modified user accounts, scheduled tasks, or cron entries on the FileMaker Cloud host.

Detection Strategies

• Inspect Admin Console audit logs for connection-test actions paired with anomalous ODBC parameter values.
• Monitor process trees for the FileMaker Cloud service launching interpreters such as sh, bash, cmd.exe, or powershell.exe.
• Alert on file writes to system directories by the FileMaker Cloud service account.

Monitoring Recommendations

• Forward Admin Console and OS-level process telemetry to a centralized SIEM for correlation.
• Baseline normal ODBC connection-test activity and flag deviations in source IP, frequency, or parameter content.
• Track changes to administrator accounts on FileMaker Cloud and the underlying host.

How to Mitigate CVE-2026-43685

Immediate Actions Required

• Upgrade Claris FileMaker Cloud to version 2.22.0.5 or later without delay.
• Rotate Admin Console credentials and enforce multi-factor authentication where supported.
• Audit existing administrator accounts and revoke unused or excessive privileges.
• Review Admin Console and host logs for prior indicators of exploitation.

Patch Information

Claris fixed CVE-2026-43685 in FileMaker Cloud 2.22.0.5. Apply the update through the standard Claris upgrade workflow. Vendor guidance is available in the Claris Support Article.

Workarounds

• Restrict network access to the Admin Console using firewall rules or VPN gating until the patch is applied.
• Limit Admin Console privileges to a minimal set of trusted operators.
• Disable or avoid use of the External ODBC Data Source connection test feature until the upgrade is completed.

# Configuration example: restrict Admin Console access to a trusted management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP