Trust Center
Welcome to UiPath Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. UiPath maintains a comprehensive information security management system and engages independent auditors to provide industry-standard certifications and attestations.
• You can subscribe for updates and share the page with the icons on left of this page.
• CVE or vulnerabilities and reporting a security issue can be entered at the bottom in contact support or report issue links.
For UiPath legal information please visit - UiPath Trust Portal – Built for Secure Agentic Scale (https://www.uipath.com/legal/trust-and-security).
Trust Center Updates
Pre-Production Security Event October 26, 2026
We detected a security event on October 26th. Upon detection of this event, access to some services was suspended to protect our customers, partners, and employees out of an abundance of caution and following our security guidelines. As part of this shutdown, the availability of customer services related to Insights, Automation Ops, and Cloud Robots were temporally affected. Services have been fully restored after ensuring the safety and security of the environment. There is no indication that customer data or any services that process customer data were affected by this event.
Brotli Decoder Vulnerability (CVE-2026-111497)
UiPath Trust Operations is aware of the vulnerability affecting Google's Brotli compression decoder commonly referenced as CVE-2026-111497. This vulnerability affects the Google Brotli library, Node.JS and Python libraries that use Brotli. We are investigating the impact to our products and services and will provide notification updates to this post accordingly.
PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Update. UiPath installed products and Automation Cloud services are not affected by these vulnerabilities as they do not leverage PHP and customers are not affected by usage of any UiPath product.
UiPath corporate assets and websites are mitigated against the vulnerability. Remediation efforts will continue, but customers remain unaffected. There has been no indication of any compromise associated with this vulnerability.
Our investigation is ongoing and we will provide additional updates as it progresses.
At this time, we have NOT identified any UiPath installed products or Automation Cloud services that are affected by these vulnerabilities as they do not leverage PHP and believe customers are not affected by usage of any UiPath product.
We are still working through all UiPath corporate assets as well as our various websites that are not part of the UiPath product landscape. Notably, UiPath does leverage Cloudflare as a WAF in front of our websites which has deployed a mitigating rule for php2shell to protect against attacks associated with this vulnerability.
Apache Tomcat 11 Vulnerabilities
This Advisory is for the following Apache Tomcat Vulnerabilities. Security scanners may return results that these vulnerabilities are present in some UiPath and legacy WorkFusion products.
UiPath has investigated this set of vulnerabilities and confirmed that these are mitigated as are product hardening prevents exploitation for all of these vulnerabilities. UiPath will update the version of tomcat as part of normal regular patching in a future update.
CVE-2026-101296
CVE-2026-101356
CVE-2026-103119
CVE-2026-93446
CVE-2026-88041
CVE-2026-74049
CVE-2026-74048
CVE-2026-80353
Security Advisory - ArgoCD Vulnerability Mitigation
UiPath Security Advisory - ArgoCD
UiPath is recommending all Automation Suite customers implement the documented mitigation linked below to address a High Severity Vulnerability in ArgoCD as soon as possible. This RCE vulnerability does not have a CVE number and ArgoCD has not released a patch to address it.
Automation Suite 2.2510 Documentation
Automation Suite 24.10 Documentation
Automation Suite 23.10 Documentation