Date: 6 October 2026
Severity: Critical
Audience: Operators of Cumulocity environments
Applies to: Yearly releases and Edge
Action required: Upgrade the environment or, at minimum, the specified microservices.
Overview
A critical security vulnerability has been identified in specific Cumulocity Platform microservices that could potentially allow unauthorized access to sensitive information or functionality under certain conditions.
A validated security fix is now available. Customers operating affected microservices are strongly advised to apply the applicable updates and complete the mandatory post-update subscription refresh described below.
Scope of Impact
This advisory applies only to deployments running one or more of the following microservices:
- Loriot
- Sigfox
- Actility
The affected deployment types are:
- Cloud-operated environments: Cumulocity environments running on yearly release cycles.
- Self-hosted Cumulocity installations: Customer-operated Cumulocity installations.
- Cumulocity Edge deployments: Edge deployments running on Kubernetes. Note that the above services are not part of a default Edge installation.
Note: Deployments that do not use the Loriot, Sigfox, or Actility microservices are not affected by this specific vulnerability.*
Required Actions
1. Apply the Security Fix
Customers should apply the applicable Cumulocity platform maintenance release, or upgrade the affected microservices to the versions listed below..
Cumulocity Cloud Deployments
For environments running the 2026 yearly release, retrieve the latest maintenance release from the Cumulocity Installation Artifact Registry and upgrade the environment to the latest available 2026.9 patch level, following the instructions in the Cumulocity Multi-Node Installation Guide.
If you are using y2025 release or a complete platform upgrade is not immediately possible, the affected microservices must be upgraded to the following versions:
| Microservice | Cumulocity 2026 | Cumulocity 2025 |
|---|---|---|
| Loriot | 3.0.44 | 2.1.18 |
| Sigfox | 2.0.37 | 1.17.15 |
| Actility | 2.0.62 | 1.31.24 |
Edge Deployments
For customers operating Cumulocity Edge:
- Verify whether the deployment includes the Loriot, Sigfox, or Actility microservices.
- If any of these microservices are deployed, upgrade them to the corresponding fixed versions listed above.
- Complete the mandatory subscription refresh described in the next section.
2. Mandatory Post-Patch Subscription Refresh for Loriot and Sigfox Microservices
This step is required after applying the security fix.
After successfully deploying the updated microservice versions, administrators must refresh the subscriptions for the affected microservices. This clears and re-establishes the cached user context and credentials associated with the microservice and ensures that the updated access-control policies are applied.
Steps to refresh microservice subscriptions:
- Log in to Cumulocity UI’s management tenant.
- Navigate to Administration → Ecosystem → Microservices.
- Locate the Loriot and/or Sigfox microservices.
- For each of the above microservice, unsubscribe and resubscribe to the microservice.
- Verify that the application is operational following the resubscription.
The microservice upgrade alone is not sufficient. The subscription refresh must also be completed.
Support
If you have additional questions or need further clarification, please contact Support