A flaw in Claris FileMaker Cloud allows an administrator to bypass a front‑end restriction that controls which operating‑system script schedules can be created. By exploiting this bypass, attackers with Admin Console privileges can run arbitrary OS commands on the underlying host, resulting in full control over the server and all data it stores and services.

The vulnerability affects Claris FileMaker Cloud; the specific fix is provided in version 2.22.0.5. No other vendors or product versions are listed as affected.

Because the flaw permits arbitrary command execution, it is a high‑impact Remote Code Execution vulnerability with a CVSS score of 7.2. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Nevertheless, the lack of mitigation makes this a critical risk for any deployment that retains unused privileged admin console access. An attacker with such access could compromise the host, exfiltrate data, and pivot to other systems.