ERPNext 15.119.1 and 16.32.0 Security Update Guide

October 13, 2026

ERPNext administrators should check the release boundaries for CVE-2026-109652 before scheduling an update. The maintainer advisory describes server-side template injection caused by missing validation. The published CNA ranges are versions below 15.119.1 and versions from 16.0.0-beta.1 up to, but not including, 16.32.0. Matching official repair releases are v15.119.1 and v16.32.0.

Do not narrow the earlier affected range to version 15

The CNA’s first interval begins at version 0 and ends before 15.119.1. It does not say that only version 15 installations are affected. Owners of older installations need to check the supported migration or repair path with the maintainer or hosting provider. This advisory does not establish continued support for an older branch.

For installations following the version 15 release line, the verified repair floor is 15.119.1. For affected version 16 installations, it is 16.32.0. Confirm that an inventory record represents the application actually running, and identify the owner of custom applications, integrations and essential business workflows.

Plan compatibility before changing the business application

Review the supported upgrade path and release-specific notes with the application owner. Select a controlled first environment, agree on the change window and define the acceptance checks. Keep an approved recovery decision available until staged verification is complete. Avoid assuming that a generic package replacement is appropriate for every ERPNext hosting arrangement.

After moving to the applicable repaired release, verify the running application version. Test ordinary sign-in, authorized role-based workflows, integrations, background processing and reporting that the owner identifies as critical. Review application and integration errors before expanding the rollout.

If a material regression occurs, pause the next stage and document the recovery decision. Restoring an affected release can restore availability while leaving the security update unfinished. Continue only after the agreed functional checks pass.

Keep the conclusion bounded

The qualified sources establish the affected intervals and repair releases. They do not prove that a particular site is compromised, that exploitation is occurring, or that an upstream firewall resolves the application’s validation problem. Record the actual release and test results separately from any network-protection claim.

For maintenance coordination, see the business IT hub, hosting hub and security hub. The WordPress support service covers connected WordPress sites; ERPNext-specific compatibility decisions remain with the application owner.