Webinar

From Running Projects to Growing Portfolios

Register Now →
Book a discovery call
Book a discovery call

Security Heads-Up: Upcoming Security Patches for Umbraco CMS and Umbraco Forms ready on August 18, 2026 at 08 AM UTC

This is a heads-up so you can prepare for action

Anders Nis Herforth Larsen
Written by Anders Nis Herforth Larsen

Security vulnerabilities have been identified in Umbraco CMS, Umbraco Forms, and Umbraco AI. Security patches are scheduled for release on Tuesday, August 18th, 2026 at 08 AM UTC. In accordance with our security policy, we are providing this heads-up because one of the vulnerabilities is categorized as “High” to help you prepare for necessary action. Full details about the vulnerabilities will be released on Tuesday, August 18, 2026, 8 AM UTC.

What’s affected?

Umbraco CMS

  • Affected Product Version Range:

    • 14.0.0 - 14.3.3 (EOL, no patch, see below)

    • 15.0.0 - 15.4.3 (EOL, no patch, see below)

    • 16.0.0 - 16.5.0 (EOL, no patch, see below)

    • 17.0.0 - 17.6.1

    • 18.0.0 - 18.1.0

  • Severity: Moderate and High

  • Not affected: Umbraco 13 and earlier. If you’re running Umbraco 13, this issue does not apply to you.

Umbraco Forms

  • Affected Product Version Range:

    • 13.0.0 - 13.9.8

    • 17.0.0 - 17.4.7

    • 18.0.0 - 18.0.5

  • Severity: Moderate

  • This issue only affects forms that use the “sensitive data” setting on one or more fields. If none of your forms mark fields as sensitive, you are not affected.

Umbraco AI


We recommend that all users prepare to update their installations upon the release of the patches on August 18, 2026.

What if I’m on an unsupported version?

Umbraco 14, 15, and 16 have all reached End-of-Life (EOL) and will not receive a patch for the CMS issue. Unsupported versions can be subject to the vulnerability, but no fix will be published for them.

If you are running Umbraco 14, 15, or 16, the recommended path is to upgrade to a supported major version - Umbraco 17 (LTS) or Umbraco 18.

You can check the support status of your version on our Long-term Support and End-of-Life page.

How do I prepare?

For Umbraco CMS and Umbraco Forms on supported versions, we are looking at patch upgrades, and we expect them to require only minimal effort per project. These are security patches, and we advise you to allocate resources to upgrade to the latest versions as soon as possible after the release on August 18, 2026.

If you are on an End-of-Life version of Umbraco CMS, a patch upgrade will not be enough. Please use the time before Tuesday to scope a major version upgrade with your technical contact or partner.

All instructions and details will be posted here on the Umbraco blog on August 18, 2026 at 8 am UTC. 

How to upgrade?

If you're using a supported version of Umbraco CMS or Umbraco Forms, you can upgrade to a new patch version the way you normally do. Umbraco Cloud projects will automatically get the patch fixes for CMS and Forms, while the Umbraco AI upgrade remains manual. 

How do you check which version you are on? Reach out with this blog post to your technical contact for your Umbraco site with this blog post, and they will be able to take care of the necessary precautions.

Timeline

  • Notification (due to high severity): August 13, 2026

  • Patch Release: August 18, 2026, 8 AM UTC

  • Full Disclosure: The detailed security advisory will be published alongside the patch release on August 18. 

More Information

If you have any questions or comments about this advisory, make sure to get in touch with us through our dedicated security email address as listed on https://umbraco.com/security. Here you can also find information on how we handle security-related issues.

If you want to get notified about security heads-ups and advisories directly, sign up for the Umbraco Security mailing list.