vulnerabilities fixed
Monthly security update
XWiki security update June 2026
This monthly security update summarizes recent XWiki releases with security fixes, recommended upgrade actions, and public references available at the time of publication.
Publication note
Security fixes are available
New XWiki versions have been released with fixes for security issues requiring priority attention. Some of these issues remain under embargo and are expected to be publicly disclosed around 1st of September 2026. Until disclosure, this page intentionally omits technical details that could support exploitation.
Recommended version
XWiki 17.10.9
View release notes
Security fixes
XWiki security fixes included in June 2026 releases
This update covers fixed issues across critical, high and moderate severity levels in XWiki product versions released during June 2026.
vulnerabilities fixed
vulnerabilities fixed
Fixed versions
Fixed versions and references
To address vulnerabilities affecting your XWiki instance, review the fixed versions below and plan an upgrade to the latest available version or to the appropriate fixed version for your supported branch.
The fixed versions listed below were current as of June 2026, the publication date of this update. For the most up-to-date release information, refer to the linked release notes.
Versions that include security fixes
XWiki 16.10.18, XWiki 17.10.9, XWiki 18.4.2
Version guidance
Why is my version not listed as a fixed version?
Your XWiki version may not be explicitly listed in the fixed versions field. This usually means one of the following:
Your version is older than the version where the fix was introduced. In this case, we strongly recommend upgrading to a fixed version as soon as possible.
Your version is newer than the listed fixed version. In this case, the fix is already included in your version and no additional action is required for that issue.
Recommended actions
Review, plan, and prepare the upgrade
Review your current XWiki version and prioritize upgrades to a supported fixed version. Agnease can help coordinate and schedule the next upgrade while accounting for custom developments, installed extensions and deployment constraints.
Review versions
- Review your current XWiki version
- Check whether your version is affected
- Identify the relevant fixed version
Plan upgrades
- Prioritize upgrades to a supported fixed release
- Review installed extensions and available updates
- Schedule remediation around operational constraints
Prepare operations
- Ensure maintenance procedures are ready
- Check backup and restore procedures
- Validate the upgrade plan before production
Additional hardening
Complementary security improvements
Upgrading to a fixed version is the priority for addressing known vulnerabilities. In parallel, organizations can reduce exposure by strengthening access control, authentication, operational procedures and platform configuration.
Two-factor authentication
Add stronger XWiki login protection with authenticator app codes, recovery codes, trusted devices and administrator controls.
Authentication review
Review LDAP, Active Directory, SSO, OIDC, SAML, user provisioning and group synchronization to reduce access risks.
Permission cleanup
Review admin, programming, script, edit and view rights to identify broad access, risky inheritance and permission gaps.
Security process
Security maintenance process
A reliable security maintenance process combines monitoring, review, coordinated remediation and respect for responsible disclosure and security embargo procedures.
- Continuous monitoring Monitor upstream security notifications, release notes and dependency advisories.
- Security review Review platform and extension updates for security-related changes.
- Coordinated delivery Coordinate security upgrades according to maintenance contracts and operational constraints.
- Responsible disclosure Respect responsible disclosure and security embargo procedures.
References
References
Need assistance?
If you would like support interpreting these updates, evaluating exposure, or planning upgrades, please contact us.