What’s Vulnerable › Vulnerabilities
CVE-2026-46609: Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
- Severity: medium (CVSS 4.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-10 · updated 2026-10-26
- Weakness: CWE-79
Description
Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.
Affected products
- Umbraco-CMS: from 14.0.0 before 17.4.0 — fixed in 17.4.0
How to fix
Upgrade to a fixed version: Umbraco-CMS 17.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-46609 or the next vulnerability affects your stack