High severity · published May 18, 2026
CVE-2026-0983
Denial of service vulnerability in M-Files Server
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
M-Files Server · M-Files Corporation
before 26.5.16015.0; LTS 25.8.15085.13 before LTS 25.8.15085.24; LTS 26.2.15718.8 before LTS 26.2.15718.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0983
empower.m-files.com
https://empower.m-files.com/security-advisories/CVE-2026-0983
More from M-Files Server
8.6
CVE-2025-13008
Session Token Disclosure in M-Files Web
7.3
CVE-2026-0932
Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated…
6.9
CVE-2026-0931
Denial-of-service vulnerability in M-Files Server
6.5
CVE-2025-11681
Denial of Service condition in M-Files Server
4.9
CVE-2026-0663
Denial of Service condition in M-Files Server