umbraco cms vulnerabilities and fixes

Recent CVEs affecting umbraco cms, with upgrade or downgrade steps. 2 tracked.

Also searched as: umbracocms.

umbraco cms has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-06-10. Highest priority: CVE-2026-46616 (score 21/100).

• CVE-2026-46616 MEDIUM 5.4 UPGRADE Umbraco is an ASP.NET CMS
• CVE-2026-46609 MEDIUM 4.6 UPGRADE Umbraco is an ASP.NET CMS

FAQ

How do I fix umbraco cms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is umbraco cms being exploited right now?

None of the tracked umbraco cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which umbraco cms CVE should I patch first?

CVE-2026-46616 currently ranks highest (21/100): Umbraco is an ASP.NET CMS.

← Back to latest CVEs