Gfi Archiver vulnerabilities

CVE-2026-2039 [CRITICAL] CWE-862 CVE-2026-2039: GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerabilit GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Store.Remoting.exe process, whic

CVE-2026-2038 [CRITICAL] CWE-862 CVE-2026-2038: GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which

CVE-2024-11948 [CRITICAL] CWE-1395 CVE-2024-11948: GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote at GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from the use of a vulnerable versio

CVE-2026-2036 [HIGH] CWE-502 CVE-2026-2036: GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists w

CVE-2026-2037 [HIGH] CWE-502 CVE-2026-2037: GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This v GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists w

CVE-2024-11947 [HIGH] CWE-502 CVE-2024-11947: GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. Thi GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Core Service, which listens on TCP port 8017 by d

CVE-2024-11949 [HIGH] CWE-502 CVE-2024-11949: GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. Th GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Store Service, which listens on TCP port 8018 by

CVE-2021-29281 [CRITICAL] CVE-2021-29281: File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implem File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.

CVE-2025-35940 [HIGH] CWE-798 CVE-2025-35940: The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to access protected ArchiverSpaApi URL endpoints.