CVE-2026-86938 Overview
CVE-2026-86938 is a DLL hijacking vulnerability in the FileMaker Pro installer for Windows. A local user can place a malicious dynamic link library (DLL) file in the installer directory. The installer loads the attacker-controlled DLL and executes arbitrary code with elevated administrator privileges. Claris addresses the vulnerability in FileMaker Pro version 26.0.3. Refer to the Claris Support Article for vendor guidance.
Critical Impact
Local attackers can escalate privileges to administrator by planting a malicious DLL alongside the FileMaker Pro installer, enabling arbitrary code execution on Windows hosts.
Affected Products
- Claris FileMaker Pro for Windows (versions prior to 26.0.3)
- FileMaker Pro Windows installer package
- Windows endpoints where the vulnerable installer is executed
Discovery Timeline
- 2026-09-23 - CVE-2026-86938 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-86938
Vulnerability Analysis
The FileMaker Pro Windows installer searches its working directory for dependency DLLs before checking secure system locations. This insecure library search order allows a local user to stage a malicious DLL with an expected filename in the same directory as the installer. When an administrator launches the installer, Windows loads the attacker-controlled DLL into the elevated installer process. The malicious code then inherits the elevated token, resulting in local privilege escalation and arbitrary code execution.
Root Cause
The root cause is improper control of the dynamic library search path in the FileMaker Pro installer binary. The installer does not enforce fully qualified paths or signature validation when loading its dependency DLLs. This class of flaw is commonly tracked as DLL search order hijacking and is closely related to CWE-427 (Uncontrolled Search Path Element) and CWE-426 (Untrusted Search Path).
Attack Vector
The attack requires local access to the host and the ability to write to the directory containing the installer. A low-privileged user drops a crafted DLL matching a name the installer resolves at runtime. Social engineering or standard administrative software deployment then triggers execution of the installer under an elevated context. The planted DLL executes with administrator privileges, giving the attacker full control of the endpoint.
No verified public proof-of-concept code is available for this issue. See the Claris Support Article for vendor-published technical details.
Detection Methods for CVE-2026-86938
Indicators of Compromise
- Unexpected DLL files placed in directories that also contain the FileMaker Pro installer executable, particularly in user-writable locations such as Downloads or Temp.
- FileMaker Pro installer processes loading DLLs from non-standard paths instead of C:\Windows\System32 or the installer's protected program files directory.
- Child processes spawned by the FileMaker Pro installer that do not match legitimate setup activity, such as cmd.exe, powershell.exe, or unsigned binaries.
Detection Strategies
- Monitor Windows Sysmon Event ID 7 (Image Loaded) for the FileMaker Pro installer loading unsigned or user-writable DLLs.
- Alert on file-write events that create DLLs in the same directory as installer executables shortly before installer launch.
- Correlate elevation events (Event ID 4688 with elevated tokens) tied to the FileMaker Pro installer with subsequent anomalous process creation.
Monitoring Recommendations
- Baseline the legitimate DLL dependencies of the FileMaker Pro installer and alert on deviations across managed endpoints.
- Track user activity that writes files with .dll extensions into directories containing setup binaries.
- Review endpoint detection and response (EDR) telemetry for privilege escalation patterns originating from installer processes across the fleet.
How to Mitigate CVE-2026-86938
Immediate Actions Required
- Upgrade FileMaker Pro for Windows to version 26.0.3 or later on all managed and unmanaged endpoints.
- Restrict installer execution to trusted directories that low-privileged users cannot write to, such as protected staging shares.
- Audit endpoints for any prior execution of the vulnerable installer and investigate hosts that show anomalous DLL loads.
Patch Information
Claris addresses CVE-2026-86938 in FileMaker Pro version 26.0.3. Administrators should download the patched installer from Claris and redeploy through their standard software distribution channels. Full remediation details are published in the Claris Support Article.
Workarounds
- Copy the FileMaker Pro installer to a clean, access-controlled directory such as an administrator-only folder before execution.
- Enforce application allowlisting through Windows Defender Application Control (WDAC) or AppLocker to block unsigned DLL loads by installer processes.
- Remove local administrator rights from standard users to reduce the impact of installer-based privilege escalation attempts.
# Configuration example: AppLocker DLL rule to block unsigned DLLs from user-writable paths
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
-Path "%OSDRIVE%\Users\*\Downloads\*.dll" -RuleNamePrefix "Block-Installer-DLL-Hijack"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
