An authenticated user can trigger a crash of the MFserver process in M‑Files Server, causing a denial‑of‑service condition. The flaw is an internal crash‑handling issue identified as CWE‑1286, which forces the critical process to terminate and makes the server temporarily unusable until it is restarted.

The vulnerable product is M‑Files Corporation’s M‑Files Server. Versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 are affected. All newer releases contain the fix.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because an attacker must be authenticated, the attack surface is restricted to legitimate or compromised user accounts. Once authenticated, an attacker can repeatedly cause the MFserver process to crash, disrupting service for all users until the server is restarted. The lack of a publicly known exploit reduces immediate risk, but the potential for service disruption remains significant.