CVE-2026-2038 is a critical missing authorization flaw (CVSS 9.8) in the MArc.Core.Remoting.exe process of GFI Archiver. A remote attacker could bypass authentication on port 8017 without credentials. Zero Day Initiative lists the fix as version 15.11, so upgrade to it.
What's affected
GFI Archiver installations are affected. ZDI's advisory ZDI-26-075 says the flaw is in the MArc.Core.Remoting.exe process, which listens on port 8017, and that the fixed version is 15.11. It also says an attacker could chain it with other flaws to run code as SYSTEM.
How to check if you're exposed
In the GFI Archiver console, look at the installed version. Anything below 15.11 needs the update. On the server, check whether the port is listening and who can reach it:
netstat -ano | findstr :8017
Also review firewall rules for that port.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Check the Archiver version on every installation.
- Upgrade to 15.11 or later using GFI's release documentation.
- Block ports 8017 and 8018 from everything except the Archiver components that need them.
- Review the server for unexpected services or accounts if the ports were reachable from untrusted networks.
Why it matters
The weakness is CWE-862, missing authorization. The remoting service allows access to functionality without checking who is asking. Remoting interfaces are meant for trusted internal components, and exposing one to a wider network turns a design assumption into a vulnerability.
A mail archive holds a company's communications, so access is valuable on its own. ZDI notes a chain to SYSTEM code execution is possible. The sibling flaw CVE-2026-2039 is the same kind of problem on port 8018. The CVE is not in CISA's KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What version fixes it?
15.11, per ZDI's advisory.
Is CVE-2026-2039 fixed in the same version?
ZDI lists 15.11 for both advisories.
Sources
Last reviewed: 19 October 2026.
