Craft CMS and Commerce-mollie need updates, Cyber Centre says
Original title: Craft CMS security advisory (AV26-1086)
CMS before 4.18.9 and 5.11.2, and Commerce-mollie before 4.4.3, are affected as of October 23.
Canada's Cyber Centre advisory AV26-1086, dated October 26, 2026, says Craft CMS is affected by vulnerabilities in CMS and Commerce-mollie. Affected releases are CMS prior to 4.18.9 and prior to 5.11.2, and Commerce-mollie prior to 4.4.3. The centre points administrators to the vendor advisories and tells them to apply necessary updates. The notice does not describe the flaws or name CVE identifiers.
Unconfirmed: The notice does not describe what the vulnerabilities allow or whether they are being exploited.
- The advisory serial is AV26-1086 and the date is October 26, 2026.
- Status is given as of October 23, 2026.
- Listed update targets include craftcms/cms 5.11.2 and craftcms/commerce-mollie 4.4.3.
- No exploitation status or vulnerability impact is stated.
| Product | Affected | Fixed in |
|---|---|---|
| Craft CMS CMS | Prior to 4.18.9 and prior to 5.11.2 | 4.18.9 and 5.11.2 |
| Craft CMS Commerce-mollie | Prior to 4.4.3 | 4.4.3 |
- 1.Review the linked Craft CMS security advisories and apply available CMS and Commerce-mollie updates.
- Vendors
- Craft CMS
- Products
- Commerce-mollie
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1086 Date: October 26, 2026 As of October 23, 2026, Craft CMS is affected by vulnerabilities in the following products: CMS Prior to 4. 18. 9 Prior to 5.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.