Security Heads-Up: Upcoming Security Patches for Umbraco CMS, Umbraco Forms, and Umbraco AI ready on October 27, 2026 at 08 AM UTC

Please note that this issue is unrelated to the recently reported PHP security vulnerability. Umbraco depends on a different framework ( .NET).

What’s affected?

Umbraco CMS

High Severity

Affected Product Version Range:

• Umbraco 17: 17.x up to 17.7.1

• Umbraco 18: 18.x up to 18.2.1

• Umbraco 13: 13.x up to 13.16.2 (affected by a Moderate severity issue only)

Umbraco Forms

High Severity

Affected Product Version Range:

• 13.0.0 - 13.9.11

• 17.0.0 - 17.6.1

• 18.0.0 - 18.2.1

Umbraco AI

Moderate Severity

Affected Product Version Range:

• Umbraco. AI.Core: 1.0.0 - 17.6.0 and 18.0.0 - 18.6.0

• Umbraco. AI.Agent: 1.1.0 - 17.4.0 and 18.0.0 - 18.4.0

• Umbraco. AI.Agent.Deploy: 1.0.0-beta2 - 17.1.0 and 18.0.0 - 18.1.0

• Umbraco. AI.Deploy: 1.0.0-beta1 - 17.3.0 and 18.0.0 - 18.3.0

• Umbraco. AI. Search: 1.0.0-beta1 - 17.0.4 and 18.0.0 - 18.0.4

We recommend that all users prepare to update their installations upon the release of the patches on October 27, 2026.

What if I’m on an unsupported version?

Umbraco 14, 15, and 16 have reached End-of-Life (EOL) and will not receive patches for the Umbraco CMS and Umbraco Forms issues. Unsupported versions can be subject to the vulnerability, but no fix will be published for them.

If you are running Umbraco 14, 15, or 16, the recommended path is to upgrade to a supported major version - Umbraco 17 (LTS) or Umbraco 18.

You can check the support status of your version on our Long-term Support and End-of-Life page.

How do I prepare?

For Umbraco CMS, Umbraco Forms, and Umbraco AI on supported versions, we are looking at patch upgrades, and we expect them to require only minimal effort per project. These are security patches, and we advise you to allocate resources to upgrade to the latest versions as soon as possible after the release on October 27, 2026.

If you are on an End-of-Life version of Umbraco CMS (14, 15, or 16), a patch upgrade will not be enough. Please use the time before Tuesday to scope a major version upgrade with your technical contact or partner.

All instructions and details will be posted here on the Umbraco blog on October 27, 2026 at 08 AM UTC.

How to upgrade?

If you’re using a supported version of Umbraco CMS, Umbraco Forms, or Umbraco AI, you can upgrade to a new patch version the way you normally do.

How do you check which version you are on? Reach out to your technical contact for your Umbraco site with this blog post, and they will be able to take care of the necessary precautions.

If your project is on Umbraco Cloud

If your Umbraco project is hosted on Umbraco Cloud, an automatic upgrade will be rolled out on October 27, 2026 to fix the vulnerabilities for Umbraco CMS and Umbraco Forms - no action needed. If you’re running Umbraco AI on your Cloud project(s), this upgrade needs to be done manually, as it’s an add-on to your Umbraco Cloud setup.

Timeline

• Heads-up (due to high severity): Thursday, October 22, 2026

• Patch Release: October 27, 2026, 08 AM UTC

• Full Disclosure: The detailed security advisory will be published alongside the patch release on October 27, 2026.

More information

If you have any questions or comments about this heads-up, make sure to get in touch with us through our dedicated security email address as listed on https://umbraco.com/security. Here you can also find information on how we handle security-related issues.

If you want to get notified about security heads-ups and advisories directly, sign up for the Umbraco Security mailing list.