---
title: Security advisory 2026-09-10
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Improper caching of media resources

**CVSS**: 8.2\
**Affected versions**: 22.0.0 - 31.8.3\
**Category**: Caching

### Summary

Under certain shared-cache configurations (CDNs, reverse proxies), previously cached assets could remain accessible to requests without the required authentication and permission checks.

The update marks affected responses as private to prevent storage by shared caches.

### How to fix

Update to version **31.8.4** or newer. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.

If you use a CDN or reverse proxy, clear previously cached administration files after applying the update. Existing cached copies are not automatically removed by the upgrade and may remain accessible until they expire. Ensure your cache configuration respects the application's private cache-control settings.

## Insufficient endpoint validation

**CVSS**: 6.9\
**Affected versions**: 22.0.0 - 31.8.3\
**Category**: Routing

### Summary

A medium-severity routing vulnerability in one of the application's endpoints allowed unauthenticated requests to access a small number of administration endpoints. Exposure was limited to non-sensitive status information about the application. No impact on confidentiality or integrity was identified.

### How to fix

Update to version **31.8.4** or newer. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.