CVE-2026-2039 is a critical missing authorization flaw (CVSS 9.8) in the MArc.Store.Remoting.exe process of GFI Archiver. A remote attacker could bypass authentication on port 8018 without credentials. Zero Day Initiative lists version 15.11 as the fix, so upgrade and restrict the port to the hosts that need it.
What's affected
GFI Archiver installations are affected. ZDI's advisory ZDI-26-077 says the flaw is in the MArc.Store.Remoting.exe process, which listens on port 8018, and that the fix is in version 15.11. It says the flaw can be chained with others to execute code as SYSTEM.
How to check if you're exposed
Check the version in the Archiver console. Below 15.11 needs the update. Check the port on the server:
netstat -ano | findstr :8018
Then review firewall rules to see which hosts can connect.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Find every GFI Archiver installation and its version.
- Upgrade to 15.11 or later.
- Restrict ports 8017 and 8018 to the hosts that need them.
- Check the server for unexpected services if either port was exposed.
Why it matters
This is CWE-862, missing authorization, in the storage remoting service, the same class as CVE-2026-2038 in the core service. Two remoting services with the same gap suggest a shared design pattern, so fixing both together is the right approach.
The record gives network access, no privileges and no interaction, hence 9.8. The CVE is not in CISA's KEV list.
Quick check
Do I have to patch both CVEs separately?
ZDI lists the same fixed version, 15.11, for both.
What is the quickest mitigation?
Block the port from untrusted hosts, then upgrade.
Sources
Last reviewed: 19 October 2026.
