CVE-2026-0663
📋 TL;DR
This vulnerability allows authenticated attackers with vault administrator privileges to crash M-Files Server by calling a vulnerable API endpoint, causing denial of service. It affects M-Files Server versions before 26.1.15632.3.
💻 Affected Systems
- M-Files Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of M-Files Server, affecting all users and business processes dependent on the document management system.
Likely Case
Temporary service outage requiring server restart, disrupting document access and workflow processes.
If Mitigated
Limited impact with proper access controls and monitoring, potentially affecting only specific vaults.
🎯 Exploit Status
Exploitation requires authenticated access with vault administrator privileges and knowledge of the vulnerable API endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 26.1.15632.3 or later
Vendor Advisory: https://product.m-files.com/security-advisories/cve-2026-0663/
Restart Required: Yes
Instructions:
1. Download M-Files Server version 26.1.15632.3 or later from official M-Files sources. 2. Run the installer on the M-Files Server machine. 3. Follow the upgrade wizard. 4. Restart the M-Files Server service after installation completes.
🔧 Temporary Workarounds
Restrict Vault Administrator Access
allLimit vault administrator privileges to only essential personnel to reduce attack surface.
API Endpoint Monitoring
allMonitor and alert on suspicious API calls to the vulnerable endpoint.
🧯 If You Can't Patch
- Implement strict access controls to limit vault administrator accounts to trusted personnel only.
- Monitor server logs for repeated API calls to suspicious endpoints and implement rate limiting.
🔍 How to Verify
Check if Vulnerable:
Check M-Files Server version in M-Files Admin application under Help > About.Check Version:
Not applicable - use M-Files Admin GUI or check Windows Programs and FeaturesVerify Fix Applied:
Verify version is 26.1.15632.3 or later and test API functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Multiple rapid API calls from same administrator account
- M-Files Server process crashes in Windows Event Logs
Network Indicators:
- Unusual API call patterns to specific endpoints from administrator accounts
SIEM Query:
source="M-Files Server" AND (event_type="Process Crash" OR api_endpoint="vulnerable_endpoint")