# Document for FMS Version Vulnerability Patch Status? **URL:** \ **Category:** Lounge (Discussions)\ **Tags:** filemaker-server\ **Created:** [November 5, 2026, 12:21pm UTC](https://the.fmsoup.org/t/document-for-fms-version-vulnerability-patch-status/5871 "2026-11-05T12:21:25Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![OliverBarrett](https://avatars.discourse-cdn.com/v4/letter/o/f19dbf/32.png) [@OliverBarrett](https://the.fmsoup.org/u/OliverBarrett)\ **Post date:** [November 5, 2026, 12:21pm UTC](https://the.fmsoup.org/t/document-for-fms-version-vulnerability-patch-status/5871/1 "2026-11-05T12:21:25Z")
Is there a document showing which versions of FMS are fully patched? I have a client who is still on FMS 21 and is super busy at the moment. I could run the FMS installer, and most times that's all I need to do. But if the FMS installer barfs, them I'm in for a possibly long day...at least longer than the slow FMS installer itself would be. Would "upgrading" to FMS 2026 be better supported? I'm concerned that these AI threats go around "strong passwords" and "2FA" and instead just focus on vulnerabilities. Claris seems to me to be very slow at patching anything so I'm not feeling very "safe" in the light-speed AI threats that are increasing seemingly daily. With the AI threat landscape now, I'm not sure any server is safe for very long. 😰 Thanks, ---
**Author:** ![Kirk](https://yyz2.discourse-cdn.com/flex030/user_avatar/the.fmsoup.org/kirk/32/2197_2.png) [@Kirk](https://the.fmsoup.org/u/Kirk)\ **Post date:** [November 6, 2026, 6:40pm UTC](https://the.fmsoup.org/t/document-for-fms-version-vulnerability-patch-status/5871/2 "2026-11-06T18:40:29Z")
26.0.3 has all the latest security updates - I've been running it in production for a while now without issue. The following blog provides some testing that you can run against your server to see if has exposed vulnerabilities. > **[CVE-2026-86934 - Authorization Bypass in Claris FileMaker Server XML Web...](https://blog.agilehunt.com/blog/agilehunt-cve-2026-86934-claris-filemaker-authorization-bypass)** > > A single forged HTTP header re-enabled an entire admin-disabled API. This post breaks down CVE-2026-86934, a critical broken access control vulnerability in the Claris FileMaker Server XML Web Publishing Engine that let… Oddity is a free tool that will scan MacOS for vulnerabilities. > **[Oddity — Is anything odd?](https://www.hind-smith.com/Oddity/)** > > Oddity: evidence-driven macOS integrity, SSH and FileMaker Server security scanning. See what changed, and why it matters. Credentials appear to be a primary target of the current attacks (not just FM, but everything). Replace any login with the string ADMIN, DEMO, TEST, USER, etc. that could be easily guessed - in both your solutions and admin console. Check your access logs. Remove all auto-login accounts, do not use GUEST, and add the admin console feature that only lets people see what they have valid credentials for. If you can, use external authentication - that makes the current attack vectors far more difficult to exploit. Here is an AI skill that will help with FM security testing. > **[FileMaker Server Security Check: A Free Claude Skill](https://www.cadenceux.com.au/post/filemaker-server-security-check)** > > 'Secure' comes from the Latin securus: without care. A FileMaker Server set up without care is exactly what the automated attacks look for . . . [FMFathom.com](http://FMFathom.com) has added some security check features. The BETA is free. Soliant just published a checklist of things to make sure you have done to tighten down security for FMP/FMS > **[Jira Service Management](https://customer.support.soliant.cloud/servicedesk/customer/portal/4/article/764870657?utm_source=newsletter&utm_medium=email&utm_campaign=oct_newsletter)** ---
**Author:** ![OliverBarrett](https://avatars.discourse-cdn.com/v4/letter/o/f19dbf/32.png) [@OliverBarrett](https://the.fmsoup.org/u/OliverBarrett)\ **Post date:** [November 7, 2026, 2:00pm UTC](https://the.fmsoup.org/t/document-for-fms-version-vulnerability-patch-status/5871/3 "2026-11-07T14:00:04Z")
Thank you!