Is Quick Base down?

Regarding the recently reported Node.js vulnerability, tracked as CVE-2026-111497 (dubbed "Node2Shell" or "Broccoli2Shell"), affected versions of Node.js, the .NET runtime and the Google Brotli library are present in parts of Quickbase's infrastructure. One internet-facing supporting service was found to have a path to the vulnerable code. A fix for it has been developed and is being deployed as a priority. The core Quickbase platform cannot be exploited in its current production configuration. Components where the vulnerable code cannot be reached are also being updated to patched versions, in line with our standard vulnerability management practices. The investigation is ongoing, and new findings are triaged and escalated for remediation as soon as they are identified. Quickbase is not aware of any exploitation of this vulnerability, and no customer action is required.

We are experiencing an issue with logging into the Quickbase Support Portal and submitting support cases. Our hosting provider has acknowledged the issue on their end and are working to fix this as soon as possible. There is no impact to the Quickbase platform that hosts Quickbase applications. We apologize for the inconvenience and will provide an update as soon as we have one.

The Quickbase Support Portal is now accessible. Our hosting provider has confirmed the login issue is resolved.

Regarding the recently reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (known as PHP2Shell), Quickbase products or services used by customers are not impacted by these vulnerabilities. On October 21, 2026, PHP released fixes for two critical remote code execution vulnerabilities. We reviewed our environment as soon as they were published. Quickbase platform and products: We do not use PHP in the Quickbase platform or products. These vulnerabilities do not affect them. Customer data: We found no impact to customer data or to the services customers use. Internal systems: We found one legacy internal service that uses PHP. It supports our marketing operations It is not reachable from the Internet. It does not store or process customer data. We are updating it to a fixed PHP version. Monitoring: We reviewed our systems and found no sign of compromise. We continue to monitor.

We are currently investigating an issue where a subset of poller based Pipelines are failing to trigger or experiencing a delay in triggering. We will provide an update as soon as we have one.

The issue has been resolved and Pipelines have resumed to normal operations. Root cause to follow.

Starting at 10:20 AM Eastern US Time, the Quickbase Exact Forms Plus extension intermittently generated documents for some customers that showed a "Created with a trial version of Syncfusion PDF library" watermark. Some customers also saw an Exact Forms Plus error page with no message. The frequency of this issue peaked between 2:20 PM and 4:50 PM Eastern US Time.

We deployed a fix to this issue at 4:40 PM Eastern US Time and the last occurrences ended by 5:00 PM Eastern US Time. The Exact Forms Plus extension has been operating normally since that time. No document data was lost or exposed during this incident. If you have watermarked documents, regenerate them to get clean copies. If you see the watermark on a document generated after September 30, 5:00 PM Eastern US Time, please let us know.

The Exact Forms Plus extension uses a third-party document library named Syncfusion that needs a license key to be loaded when the extension starts. Under certain conditions, the Syncfusion license key was intermittently not being loaded properly and document requests being handled by Exact Forms Plus at that moment would produce the "Created with a trial version of Syncfusion PDF library" watermark. Our software fix changed how the Syncfusion license key was being loaded to ensure it will always be available for any Exact Forms Plus document request.