PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46609 umbraco CVE debrief

CVE-2026-46609 is a MEDIUM severity vulnerability in Umbraco CMS. From version 14.0.0 to before version 17.4.0, authenticated users can inject HTML into an input field. This injected HTML is then rendered in the confirmation dialog without proper output encoding. The vulnerability has been patched in version 17.4.0.

Vendor
umbraco
Product
Umbraco-CMS
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-12
Advisory published
2026-06-10
Advisory updated
2026-06-12

Who should care

Users of Umbraco CMS, particularly those using versions between 14.0.0 and 17.4.0 (exclusive), should be aware of this vulnerability. Successful exploitation requires authentication and user interaction.

Technical summary

The vulnerability exists in Umbraco CMS versions from 14.0.0 to before 17.4.0. Authenticated users can inject HTML into an input field, which is then rendered in the confirmation dialog without proper encoding. The CVSS score for this vulnerability is 4.6, indicating a MEDIUM severity.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade to Umbraco CMS version 17.4.0 or later.
  • Ensure that user input is properly encoded before rendering in dialogs.

Evidence notes

CVE-2026-46609 has been analyzed and verified by official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46609 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46609

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46609 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46609

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.