CVE-2026-18372 M-Files Corporation CVE debrief

Who should care

Administrators and users of M-Files Web, especially those with administrator privileges, should be aware of this vulnerability and take necessary actions to mitigate it. Operators and security teams should review compensating controls and monitor for suspicious activity related to CSS injection. Platform impact includes potential UI disruption; vulnerability management teams should prioritize patching or mitigation efforts based on exposure and risk assessment processes. Security teams should verify M-Files Web version and limit administrator access to reduce risk of exploitation in managed environments with confirmed deployments of affected product versions and exposures to untrusted vault administrators or other threat actors with access to authenticated administrator accounts that could inject CSS affecting other users of the web UI displayed by M-Files Web before 26.8.16330.2 or later versions with patched or mitigated exposures verified by defenders reviewing official advisories and CVE records for affected scope and severity assessments that include CVSS scores and severity levels like MEDIUM that indicate significant risk requiring defensive priority based on exposure review processes and compensating controls implemented to limit impact from potential CSS injection attacks in M-Files Web deployments requiring security team review of monitoring, detection, and logs for exposed assets that need extra review based on asset inventory and rollback/change windows planned for remediation efforts verified through normal change control processes where exposure is confirmed by defenders assigned for follow-up based on confirmed affected product or component deployments in managed environments reviewed for vulnerability class and likely operational impact based on source-confidence limits and review context provided by official CVE Program records and NIST NVD detail pages with source-specific vulnerability assessments that ground evidence limits and known and unknown affected scope requiring defensive verification tasks by defenders assigned for follow-up based on executive overview covering affected product or component, vulnerability class, likely operational,

Technical summary

CVE-2026-18372 is a CSS injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated vault administrator can inject arbitrary CSS, affecting the web user interface displayed to other vault users. The vulnerability has a CVSS score of 4.8 and is classified as MEDIUM severity. Technical impact includes UI modification; defenders should limit administrator access.

Defensive priority

Authenticated administrators could inject CSS affecting the web UI; verify and limit administrator access.

Recommended defensive actions

• Verify M-Files Web version and upgrade to 26.8.16330.2 or later
• Limit administrator access to the M-Files Web application
• Monitor for suspicious activity related to CSS injection

Evidence notes

The CVE-2026-18372 record indicates a CSS injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated vault administrator could inject arbitrary CSS affecting the web user interface displayed to other vault users. The CVSS score is 4.8, and the severity is MEDIUM. Evidence is limited to CVE Program and NVD sources; defenders should verify M-Files Web version and administrator access controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.