Kadence experienced a major incident on October 21, 2026 affecting 🇺🇸 US Data Region (Login & Authentication) and 🇺🇸 US Data Region (API Services), lasting 3h 44m. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- investigating Oct 21, 2026, 04:20 PM UTC
We’ve temporarily disabled file uploads across Kadence as a precautionary measure following the disclosure of two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619). During this time, any action that involves uploading a file (bulk imports, profile photos and visitor document uploads) will not complete and may return an error. All other features are working normally. There is no evidence that any customer data has been affected. We’ll restore uploads once the required updates have been applied, which we expect within the next few hours, and will update this page as work progresses.
- resolved Oct 21, 2026, 08:04 PM UTC
File uploads restored We've applied the security updates for CVE-2026-109618 and CVE-2026-109619, and file uploads have been re-enabled across Kadence. These were industry-wide vulnerabilities in PHP, not specific to Kadence. All features, including bulk imports, profile photos and visitor document uploads, are now working normally. There is no evidence that any customer data was affected. Thank you for your patience.