CVE-2026-43680 Command injection in FileMaker Cloud
An admin can bypass script restrictions to execute arbitrary OS commands on the host, requiring an upgrade to FileMaker Cloud.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43680?
CVE-2026-43680 is a high-severity command injection vulnerability in Claris FileMaker Cloud, published on 12 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a front-end restriction on OS Script schedule types and execute arbitrary operating system commands on the underlying host. This issue is fixed in FileMaker Cloud 2.22.0.5.
Weakness: CWE-94
Which versions are affected by CVE-2026-43680?
It affects 1 product.
Products include Claris Filemaker Cloud.
How do I fix CVE-2026-43680?
No fix has been published for CVE-2026-43680 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-43680 being exploited?
There is no known exploitation of CVE-2026-43680 in the wild and no public exploit code.
Other vulnerabilities in Claris FileMaker Cloud
Sources
Also known as GHSA-9682-24hm-2gh4.