Skip to content
umbracolombia

Bogotá

Umbraco in Spanish / Monthly roundup · October 2026

Umbraco roundup for October 2026, with two rounds of security patches and a .NET update

Umbraco in October 2026: 14 vulnerabilities fixed across CMS, Forms and AI, an out-of-band .NET update, the uSync 19 beta, Articulate 7 and 8.

Author
Equipo Umbracolombia
Published
Period
October 2026
Reading
6 min

October 2026 was a patching month for Umbraco. In two security releases three weeks apart, Umbraco fixed fourteen vulnerabilities across the CMS, Umbraco Forms and Umbraco AI, and Microsoft shipped an out-of-band .NET update in between. If you run Umbraco 17 or 18, the versions to be on are CMS 17.7.2 or 18.2.2 and Forms 17.6.2 or 18.2.2. On Umbraco 13 they are CMS 13.16.3 and Forms 13.9.12. Check those before you read further.

Almost everything fixed in October needed someone already signed in to the backoffice. What gave way was not the public surface of the site but the permission model you hand your own editors.

October 6: four fixes for Umbraco 17 and 18

Anders Nis Herforth Larsen’s advisory on the Umbraco blog (opens in a new tab) lists two moderate and two low issues in 17.0.0-17.7.0 and 18.0.0-18.2.0, fixed in 17.7.1 and 18.2.1. Three need a backoffice account, among them restricted users deleting media outside their area. The fourth needed none: backoffice real-time endpoints leaked limited editorial activity to anonymous clients. If your site or a package uses a custom media path scheme, upgrading alone does not close the media issue; the advisory points to the documentation for the extra step.

October 27: ten more, two of them high

On October 22 Larsen published a heads-up (opens in a new tab) that high-severity patches would land on October 27 at 08:00 UTC. The affected ranges included 17.7.1 and 18.2.1, the versions released on October 6. The advisory itself (opens in a new tab) then listed ten issues: two high, seven moderate, one low.

The first high one is a backoffice account takeover through the sign-in redirect, rated CVSS 8.8. Preparing it needs no account, but a signed-in user has to open the attacker’s link, and the full chain only works where requests for unrecognized host names reach Umbraco: Kestrel exposed directly, IIS without host name bindings, or a reverse proxy that forwards the Host header unchanged. The interim advice is to restrict AllowedHosts to your own host names, a setting worth having after the upgrade too.

The second is remote code execution through Umbraco Forms workflows, also CVSS 8.8. The sentence that matters: “By default, any back-office user with access to the Forms section is permitted to manage forms.” On unpatched versions, granting the Forms section came close to granting code execution on the server. A separate Forms issue let users read and export entries of forms they had been denied.

Several of the moderate issues share a cause: start nodes did not hold. Restricted users could preview unpublished content outside their start nodes, resolve media URLs beyond them, or give their own user group start nodes they did not have. The advisory says it plainly: “Avoid relying on start nodes alone to keep unpublished content confidential from other back-office users.” Signing out also failed to invalidate the auth cookie, and preview tokens never expired. They now expire after the backoffice login timeout.

Umbraco AI got its first advisory. Agent tools ignored start nodes and item permissions, and the Umbraco Deploy integration wrote AI provider credentials unencrypted to deployment files, which usually live in source control. If yours were committed, rotate those keys after upgrading. Umbraco Cloud patched the CMS and Forms automatically, but Umbraco AI on Cloud is upgraded by hand. Umbraco 14, 15 and 16 are end of life and got no fix.

The .NET runtime needed attention too

Rahul Bhandari announced out-of-band .NET security updates (opens in a new tab) on the .NET Blog: 8.0.33, 9.0.22, 10.0.14 and .NET 11 Release Candidate 3. The main fix is a Brotli decompression buffer overflow open to unauthenticated attackers, relevant if you use ASP.NET Core request decompression or HttpClient automatic decompression, neither on by default. Self-contained apps and containers carry their own runtime, so rebuild and redeploy them.

PHP2Shell, and why Umbraco mentioned it

Both Umbraco posts from October 22 and 27 carried a note that the issues were unrelated to “the recently reported PHP security vulnerability”, a sign that the question was being asked. Bill Casey explains on the Diagram blog (opens in a new tab) why Umbraco sites are not directly affected, since Umbraco runs on .NET, and makes the useful point that PHP often survives elsewhere: old microsites, partner portals, staging servers. Justin Neville shared a read-only check script on Nevitech (opens in a new tab) for PHP sites on Azure Linux App Service, and closes with the line Umbraco teams wanted to hear: if you run Umbraco rather than WordPress, “this one doesn’t affect you”.

Planning the move off Umbraco 13

Neville also wrote the case for moving from Umbraco 13 to 17 now (opens in a new tab): the Cyber Essentials requirement that in-scope software be vendor-supported, and rough timescales from one to two weeks for a brochure site to several months for commerce or custom backoffice work. For the dates, use Umbraco’s Long-term Support and End-of-Life page, linked from both October advisories.

Tooling that moved

Kevin Jump published the first uSync beta for the next Umbraco major (opens in a new tab), with a clear warning not to run it on a production site. uSync moves into its own Synchronisation section, and its API tightens: “Before, any user with the Content section could call it.”

Articulate 7 and 8 (opens in a new tab) shipped for Umbraco 17 and 18 from a single codebase, two packages only because those Umbraco versions are not binary compatible. The page credits no author; it is written in the first person on Shazwazza, Shannon Deminick’s blog, and thanks Gavin Faux for most of the work. MetaWeblog is now off by default because it bypasses backoffice OAuth and two-factor sign-in, and the build fails on any high or critical NuGet advisory.

Corné Hoskam released Engage Healthcheck (opens in a new tab), a read-only tool that tells you which Umbraco Engage version a database matches and what differs from it. Hoskam is clear that it is a personal, experimental project and not an Umbraco product.

Community news was quieter

Asha Chaudhary’s uProfile on the Umbraco blog (opens in a new tab) highlights the Umbraco Education Program for students in India and a Sitecore-to-Umbraco migration. Lasse Fredslund’s US Partner Summit awards recap (opens in a new tab) has the month’s most concrete figure, as reported by Umbraco: Proworks’ MCP-based publishing engine brought a new page under ten minutes of human time. Owain Williams wrote up the UK Partner Summit and conference (opens in a new tab) in London, where a talk on Umbraco Cloud left him saying it “finally feels like a product you can use in the real world”.

What to do now

Patch first. Then put backoffice permissions on the same list as version numbers: who holds the Forms, Users and Media sections, whether AllowedHosts is set, and whether AI provider keys sit in committed Deploy files. If a site separates editors or tenants with start nodes alone, October is a good reason to stop calling that isolation.

Sources