Vulnerability · Published Feb 20, 2026 · Assigned by zdi

CVE-2026-2038GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability

High 7.3

In plain English

A high-severity missing authorization in Archiver from GFI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.0)7.3High

Exploit odds (30 days)0.7%top 46.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-27934.

Affected products (as reported)

Vendor	Product	Versions
GFI	Archiver	15.10

Weakness: CWE-862 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

ZDI-26-075 x_research-advisory