CVE-2026-0983

Denial of service vulnerability in M-Files Server

State: Published
Severity: 7.1 High
Published: May 18, 2026
Updated: May 18, 2026
Reserved: Jan 15, 2026

Description

Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	M-Files Corporation

Weaknesses

CWE-1286 Improper validation of syntactic correctness of input

Affected Products

Product	Versions
M-Files ServerM-Files Corporation	before 26.5.16015.0Affected LTS 25.8.15085.13 to before LTS 25.8.15085.24Affected LTS 26.2.15718.8 to before LTS 26.2.15718.10Affected

References

https://empower.m-files.com/security-advisories/CVE-2026-0983vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.