Book a discovery call
Book a discovery call

Security Heads-Up: Upcoming Security Patches for Umbraco CMS, Workflow, Commerce, Engage, and Umbraco MCP Server SDK

Heads-up: Fixes will be released on November 17, 2026 at 08 AM UTC

Anders Nis Herforth Larsen
Written by Anders Nis Herforth Larsen

Security vulnerabilities have been identified in Umbraco CMS, Umbraco Workflow, Umbraco Commerce, Umbraco Engage, and the Umbraco MCP Server SDK. Security patches are scheduled for release on Tuesday, November 17, 2026 at 08 AM UTC. In accordance with our security policy, we are providing this heads-up so you can prepare to take necessary action, as several of the vulnerabilities are categorized as “High”. Full details about the vulnerabilities and patch fixes will be released on Tuesday, November 17, 2026 at 08 AM UTC.

What’s affected?

Umbraco CMS

Moderate Severity

Affected Product Version Range:

  • 13.0.0 - 13.16.4

  • 12.x and 14.0.0 - 15.4.4 (EOL, no patch, see below)

Not affected: Umbraco CMS 17 and 18. If you’re running Umbraco 17 or 18, this issue does not apply to you.

This issue only affects sites that have the Content Delivery API enabled (it’s disabled by default) and that use Public Access protection or exclude content types from the Delivery API. If your site doesn’t use the Delivery API, you are not affected.

Moderate Severity

Affected Product Version Range:

  • 17.4.0 - 17.8.1

  • 18.0.0 - 18.3.1

Not affected: Umbraco CMS 13. If you’re running Umbraco 13, this issue does not apply to you.

This issue only affects sites with member properties marked as sensitive.

Umbraco Workflow

High Severity (two vulnerabilities)

Affected Product Version Range:

  • 13.0.0 - 13.5.4

  • 17.0.0 - 17.5.4

  • 18.0.0 - 18.2.5

Both issues can only be exploited by users with a backoffice login.

Umbraco Commerce

High Severity

Affected Product Version Range:

  • 13.0.0 - 13.3.3

  • 17.0.0 - 17.2.12

  • 18.0.0 - 18.1.12

This issue can only be exploited by users with a backoffice login. It mainly affects sites where not all backoffice users are meant to access Commerce data, or where Commerce users are limited to specific stores.

Umbraco Engage

High Severity

Affected Product Version Range:

  • 13.0.0 - 13.8.2

  • 17.0.0 - 17.5.0

  • 18.0.0 - 18.2.0

This issue affects all sites with Umbraco Engage installed, but it can only be exploited by users with a backoffice login.

Umbraco MCP Server SDK

High Severity

Affected Product Version Range:

  • @umbraco-cms/mcp-hosted 17.0.0-beta.5 - 17.0.0-beta.29

  • @umbraco-cms/mcp-hosted 1.0.0-beta.30 - 1.0.0-beta.47

This issue only affects sites that run a hosted MCP server built on @umbraco-cms/mcp-hosted, including servers created from the project template. If you don’t run a hosted MCP server, you are not affected.

We recommend that all users prepare to update their installations upon the release of the patches on November 17, 2026.

What if I’m on an unsupported version?

Umbraco CMS 12, 14, and 15, and Umbraco Workflow and Umbraco Commerce 14, 15, and 16, have reached End-of-Life (EOL) and will not receive a patch for these issues. Unsupported versions can be subject to vulnerabilities.

If you are running one of these versions, the recommended path is to upgrade to a supported major version - Umbraco 17 (LTS) or Umbraco 18.

You can check the support status of your version on our Long-term Support and End-of-Life page.

How do I prepare?

For Umbraco CMS, Umbraco Workflow, Umbraco Commerce, Umbraco Engage, and the Umbraco MCP Server SDK on supported versions, we are looking at patch upgrades, and we expect them to require only minimal effort per project. These are security patches, and we advise you to allocate resources to upgrade to the latest versions as soon as possible after the release on November 17, 2026, 8 AM UTC.

If you are on an End-of-Life version of Umbraco CMS, Umbraco Workflow or Umbraco Commerce, a patch upgrade will not be enough. Please use the time before Tuesday to scope a major version upgrade with your technical contact or partner.

All instructions and details will be posted here on the Umbraco blog on November 17, 2026 at 08 AM UTC.

How to upgrade?

If you’re using a supported version of Umbraco CMS, Umbraco Workflow, Umbraco Commerce, Umbraco Engage or the Umbraco MCP Server SDK, you can upgrade to a new patch version the way you normally do.

How do you check which version you are on? Reach out to your technical contact for your Umbraco site with this blog post, and they will be able to take care of the necessary precautions.

If your project is on Umbraco Cloud

If your Umbraco project is hosted on Umbraco Cloud, an automatic upgrade will be queued on 17 November 2026. Your project will be upgraded during its next upgrade window (check the scheduled upgrade feature to see and select your upgrade windows).

If you’re running Umbraco Workflow, Umbraco Commerce, or Umbraco Engage on your Cloud project(s), this upgrade needs to be done manually, as they’re add-ons to your Umbraco Cloud setup. A hosted MCP server built on the Umbraco MCP Server SDK runs outside Umbraco Cloud, so it also needs to be upgraded manually.

Timeline

  • Notification (due to high severity): November 12, 2026

  • Patch Release: November 17, 2026, 8 AM UTC

  • Full Disclosure: The detailed security advisory will be published alongside patch fixes on November 17, 2026, 8 AM UTC.

More information

If you have any questions or comments about this heads-up, make sure to get in touch with us through our dedicated security email address as listed on https://umbraco.com/security. Here you can also find information on how we handle security-related issues.

If you want to get notified about security heads-ups and advisories directly, sign up for the Umbraco Security mailing list.