PT-2026-3760 · M Files · M-Files Server

Published 2026-01-21 · Updated 2026-01-21 · CVE-2026-0663

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 26.1.15632.3

Description An authenticated attacker with vault administrator privileges can cause the M-Files Server process to crash by calling a vulnerable API endpoint. The issue is a denial-of-service condition.

Recommendations Update M-Files Server to version 26.1.15632.3 or later.

Fix

DoS

Weakness Enumeration

CWE-1286

Related Identifiers

BDU:2026-05575

CVE-2026-0663

Affected Products

M-Files Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-0663 · Security Note
• https://product.m-files.com/security-advisories/cve-2026-0663 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-0663 · Vendor Advisory
• https://empower.m-files.com/security-advisories/CVE-2026-0663 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05575 · Security Note
• https://twitter.com/CVEnew/status/2013943946737848394 · Twitter Post
• https://community.m-files.com/blogs-65091858/b/product-news/posts/m-files-january-2026-product-update · Note
• https://twitter.com/VulmonFeeds/status/2013938738116563209 · Twitter Post
• https://community.m-files.com/blogs-65091858/b/product-news · Note
• https://t.me/cveNotify/149373 · Telegram Post
• https://t.me/CVEtracker/42655 · Telegram Post