In short
- CVE-2026-46609 is a MEDIUM (CVSS 4.6) vulnerability affecting Umbraco.Cms, umbraco cms (umbraco).
- Chance of exploitation in the next 30 days (EPSS): 0.14%, higher than 3.0% of all vulnerabilities.
- Fix: update to 17.4.0 or later.
| Package | Affected versions | Patched versions |
|---|
| Umbraco.Cms NuGet | ≥ 14.0.0, < 17.4.0
| 17.4.0
|
| umbraco cms | ≥ 14.0.0, < 17.4.0
| 17.4.0
|
Description
Impact
Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding.
Patches
This issue has been patched in 17.4.0
NVD description
Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free