CVE-2026-86934 Overview
CVE-2026-86934 is an authorization bypass vulnerability in the Claris FileMaker Server Web Publishing Engine. Requests containing an extended privilege header bypass the disabled Custom Web Publishing with XML setting. Attackers reach the XML Web Publishing interface even when administrators explicitly disable it. This allows interaction with the XML publishing endpoints without honoring the server's access controls. Claris addresses the flaw in FileMaker Server version 26.0.3.
Critical Impact
Attackers can access disabled XML Web Publishing functionality on FileMaker Server, defeating administrative controls intended to restrict this attack surface.
Affected Products
- Claris FileMaker Server versions prior to 26.0.3
- FileMaker Server Web Publishing Engine component
- Deployments with Custom Web Publishing with XML administratively disabled
Discovery Timeline
- 2026-09-23 - CVE-2026-86934 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-86934
Vulnerability Analysis
The FileMaker Server Web Publishing Engine exposes the XML Web Publishing interface for programmatic access to hosted databases. Administrators disable this interface through the Custom Web Publishing with XML configuration option when it is not required. The Web Publishing Engine fails to enforce this setting when a request carries an extended privilege header. The header causes the engine to treat the request as authorized for XML publishing, granting access to endpoints that should return a disabled or unauthorized response. This is a broken access control flaw classified as an Authorization Bypass.
Root Cause
The Web Publishing Engine performs its authorization check against the extended privilege header instead of validating the administrative feature flag. When the header is present, the engine bypasses the check that would normally block XML publishing traffic. The disabled configuration state is therefore never enforced for header-carrying requests.
Attack Vector
An attacker sends an HTTP request to the FileMaker Server Web Publishing Engine containing the extended privilege header. The engine routes the request to the XML Web Publishing interface despite the disabled setting. From there, an attacker can interact with XML publishing endpoints exposed by hosted solutions. The vulnerability requires network reachability to the Web Publishing Engine and knowledge of the extended privilege header. No verified public exploit is currently listed for this CVE.
Refer to the Claris Support Article for vendor technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-86934
Indicators of Compromise
- HTTP requests to FileMaker Server Web Publishing Engine URIs referencing the XML publishing path (for example, /fmi/xml/) when the setting is disabled.
- Presence of unexpected extended privilege headers in Web Publishing Engine access logs.
- Successful XML publishing responses returned by servers where the administrator disabled Custom Web Publishing with XML.
Detection Strategies
- Review Web Publishing Engine access logs for XML endpoint requests after Custom Web Publishing with XML was disabled.
- Correlate unusual header patterns targeting FileMaker Server with source IP reputation and geolocation.
- Baseline expected client traffic to the FileMaker Server host and alert on deviations that include XML publishing paths.
Monitoring Recommendations
- Forward FileMaker Server and Web Publishing Engine logs to a centralized SIEM for retention and search.
- Alert on any HTTP 200 response from XML publishing endpoints on servers configured to disable that interface.
- Monitor network segments hosting FileMaker Server for outbound data flows following XML publishing access.
How to Mitigate CVE-2026-86934
Immediate Actions Required
- Upgrade FileMaker Server to version 26.0.3 or later on all affected hosts.
- Inventory FileMaker Server deployments and confirm patch status through the admin console.
- Restrict network access to the Web Publishing Engine to trusted management networks until patched.
Patch Information
Claris resolves CVE-2026-86934 in FileMaker Server version 26.0.3. Administrators should apply the update following the guidance published in the Claris Support Article. Verify the running version through the FileMaker Server Admin Console after installation.
Workarounds
- Place FileMaker Server behind a reverse proxy or web application firewall that strips or blocks unrecognized extended privilege headers.
- Restrict inbound access to the Web Publishing Engine ports using host and network firewalls.
- Disable the Web Publishing Engine entirely on servers that do not require web publishing functionality.
# Example firewall rule to restrict FileMaker Web Publishing access to a trusted subnet
# Adjust interface, subnet, and ports to match the environment
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
