Craft CMS security advisory (AV26-1086)

Serial number: AV26-1086
Date: October 26, 2026

As of October 23, 2026, Craft CMS is affected by vulnerabilities in the following products:

  • CMS
    • Prior to 4.18.9
    • Prior to 5.11.2
  • Commerce-mollie
    • Prior to 4.4.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Date modified: