CVE-2026-73698

This is a flaw in the part of FileRun used to add groups. It can let a trusted administrator slip harmful instructions into the system’s records, like someone with a building manager’s key using it to make copies of every key and rewrite the access list.

This matters if your business uses FileRun and gives administrator or delegated-administrator access to staff, contractors, or an external IT provider. It is only a risk if an attacker already has a high-level FileRun login.

An attacker with a high-level administrator account can use this remotely to change permissions and gain full control, so treat this as urgent. There is no confirmed public exploitation or public exploit code, but the possible impact warrants prompt remediation.

Confirm the deployed FileRun release in the administrative interface or application installation records, then inventory administrator and delegated-administrator accounts. Upgrade to FileRun 2026.3.0, the available fixed release; validate the upgrade in a backup or test environment first and review the vendor changelog for any release-specific compatibility changes.

If the upgrade must wait, limit administrator access to named trusted personnel, remove unneeded delegated-administrator accounts, and restrict access to the FileRun administration interface through your network controls. Review group creation activity, changes to permission records, newly elevated accounts, and unusual log-file listing behavior. No CISA KEV remediation due date applies because this CVE is not listed in the KEV catalog.

CVE-2026-73698 is CVSS 7.2 High (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), classified as CWE-89 SQL injection. A high-privilege authenticated user can submit list-format data through the Groups Add description field; insufficient sanitization and support for multiple database commands enable arbitrary SQL, including permission escalation. The findings also describe potential code execution through log-file handling that loads files from unvalidated input. EPSS is 0.4% (38th percentile) with a flat trend. It is not in CISA KEV, no clear dated in-the-wild exploitation has been reported, and no public exploit code is on record.