The vulnerability permits an authenticated attacker who holds vault administrator privileges to crash the M‑Files Server process by calling a specific API endpoint. This action simply disrupts service availability with no data loss or code execution. The flaw is identified by CWE‑1286, indicating improper resource management leading to instability.

M‑Files Server versions prior to 26.1.15632.3 are affected. These versions expose an API that can be invoked to trigger the crash.

The CVSS score of 6.9 places the vulnerability in the medium‑severity range, while the EPSS score of less than 1% indicates a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The attack requires authenticated access with vault administrator rights, which typically implies an insider or compromised account. Therefore, the threat is limited to environments where such privileged credentials exist, reducing the likelihood of widespread exploitation. The attack vector is inferred to be internal, requiring legitimate authentication.