Umbraco will release security patches for Umbraco CMS, Umbraco Forms and Umbraco AI on Tuesday 27 October 2026 at 08:00 UTC, which is 08:00 UK time once the clocks have gone back. Two of the vulnerabilities, one in the CMS and one in Forms, are rated high, which is why Umbraco has given advance notice rather than just publishing the fixes. If your site runs Umbraco 13, 17 or 18, it needs patching on Tuesday or very soon after. If it runs 14, 15 or 16, there will be no patch at all.
This is unrelated to the PHP security release last week. Umbraco runs on Microsoft .NET, not PHP.
Which versions are affected
Umbraco has not published the details of the vulnerabilities yet. Those come out with the patches on Tuesday. What it has published is the list of affected versions.
Umbraco CMS
Umbraco 17 up to and including 17.7.1 (high)
Umbraco 18 up to and including 18.2.1 (high)
Umbraco 13 up to and including 13.16.2 (moderate only)
Umbraco Forms (high)
13.0.0 to 13.9.11
17.0.0 to 17.6.1
18.0.0 to 18.2.1
Umbraco AI (moderate)
Umbraco.AI.Core 1.0.0 to 17.6.0, and 18.0.0 to 18.6.0
Umbraco.AI.Agent 1.1.0 to 17.4.0, and 18.0.0 to 18.4.0
Umbraco.AI.Agent.Deploy 1.0.0-beta2 to 17.1.0, and 18.0.0 to 18.1.0
Umbraco.AI.Deploy 1.0.0-beta1 to 17.3.0, and 18.0.0 to 18.3.0
Umbraco.AI.Search 1.0.0-beta1 to 17.0.4, and 18.0.0 to 18.0.4
One detail worth catching: 17.7.1 and 18.2.1 are the versions that fixed the four backoffice issues earlier this month. They are inside the affected range this time. Being patched on 6 October does not cover you for 27 October.
Umbraco Cloud and self-hosted sites are handled differently
If your site is on Umbraco Cloud, Umbraco will upgrade the CMS and Forms automatically on Tuesday. You do not need to do anything for those two.
Umbraco AI is the exception. It is an add-on, so even on Cloud it will not be upgraded for you. If your site uses any of the Umbraco.AI packages, someone has to upgrade them by hand.
If your site is hosted anywhere else, on your own servers, Azure, or a hosting company, nothing happens automatically. Someone needs to upgrade it to the patched version once it is released. On a supported version this is a patch release, not a major upgrade, so on a well-maintained site it should be a quick job.
No patch for Umbraco 14, 15 or 16
Umbraco 14, 15 and 16 have reached end of life. Umbraco has said plainly that they will not get a fix for the CMS or Forms issues, may well be vulnerable, and the only route to a patched site is a major upgrade to Umbraco 17 (the current long-term support version) or 18.
That is a bigger piece of work than a patch, and it will not be done by Tuesday. If you are on one of these versions, the useful thing to do this week is get the upgrade scoped, so you know the size of the job and when it can happen.
Umbraco 13 is covered this time, but not for much longer
Umbraco 13 is in the affected list, at moderate severity for the CMS and high for Forms, and it will get a fix on Tuesday. That will not be true for much longer. Security support for Umbraco 13 ends on 14 December 2026. The next advisory after that date will leave 13 sites in the same position as 14 to 16 are in today.
What to do before Tuesday
Find out which version of Umbraco your site runs, whether it uses Umbraco Forms, and whether it uses any Umbraco AI packages. Your developer or technical contact can tell you in a couple of minutes.
Find out whether it is on Umbraco Cloud or hosted elsewhere.
If it is self-hosted on 13, 17 or 18, book the time to apply the patch on Tuesday or as soon after as you can.
If it uses Umbraco AI, plan a manual upgrade, Cloud or not.
If it is on 14, 15 or 16, start scoping the upgrade to 17 or 18 now.
If we look after your site
Our Cloud sites will pick up the CMS and Forms fixes automatically on Tuesday morning, and we will be patching the self-hosted sites in our care, plus any Umbraco AI packages, on the day rather than waiting to be asked. If you want confirmation in writing afterwards, reply to us and we will tell you the exact version your site is on and when it was patched.
If you run Umbraco somewhere we do not manage and want a hand getting it patched, or you are on 4, 6, 7, 8, 10, 13, 14, 15 or 16 and need the upgrade scoped, get in touch.