Resolved after 3 hours 44 minutes, affecting section-325392 (Login & Authentication) and section-325392 (API Services), on October 21, 2026.
File uploads restored We've applied the security updates for CVE-2026-109618 and CVE-2026-109619, and file uploads have been re-enabled across Kadence. These were industry-wide vulnerabilities in PHP, not specific to Kadence. All features, including bulk imports, profile photos and visitor document uploads, are now working normally. There is no evidence that any customer data was affected. Thank you for your patience.
Affected components
Update timeline
- investigating Oct 21, 2026, 04:20 PM UTC
We’ve temporarily disabled file uploads across Kadence as a precautionary measure following the disclosure of two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619). During this time, any action that involves uploading a file (bulk imports, profile photos and visitor document uploads) will not complete and may return an error. All other features are working normally. There is no evidence that any customer data has been affected. We’ll restore uploads once the required updates have been applied, which we expect within the next few hours, and will update this page as work progresses.
- resolved Oct 21, 2026, 08:04 PM UTC
File uploads restored We've applied the security updates for CVE-2026-109618 and CVE-2026-109619, and file uploads have been re-enabled across Kadence. These were industry-wide vulnerabilities in PHP, not specific to Kadence. All features, including bulk imports, profile photos and visitor document uploads, are now working normally. There is no evidence that any customer data was affected. Thank you for your patience.
Your product runs on more than Kadence
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services