Craft CMS security advisory (AV26-1086)

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

  <div>
<div>
        <div><p><strong>Serial number: </strong>AV26-1086<br /><strong>Date: </strong>October 26, 2026</p>

As of October 23, 2026, Craft CMS is affected by vulnerabilities in the following products:

  • CMS
    • Prior to 4.18.9
    • Prior to 5.11.2
  • Commerce-mollie
    • Prior to 4.4.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

</div>

Article Link: Craft CMS security advisory (AV26-1086) - Canadian Centre for Cyber Security