When Moodle and IOMAD versions go end-of-life, the CVEs don’t stop.

Supported Versions: Moodle 4.3, IOMAD 4.3

Ongoing, SLA-backed security patches for anyone still running Moodle 4.3 or IOMAD 4.3, starting with backports for every known post-EOL vulnerability. Organizations stay secure and compliant while they schedule the upgrade on their own timetable.

Get Pricing
White arrow
View Moodle Docs
View IOMAD Docs

TRUSTED BY ENTERPRISE

Google logoMicrosoft logoFinra logoBank Santander Logo Hitachi LogoWorkday logoDropbox logo

On This Page:

How it WorksBrowse CVEsInstallationReadingFAQs
Get Pricing
Arrow

Security, compliance, and continuity – solved together

With our secure drop-in replacement for Moodle 4.3 and IOMAD 4.3, your scanners stop flagging CVEs in end-of-life Moodle versions for good.

Security

A new release ships each time a Moodle CVE affecting 4.3.x is found, validated, and back ported to the 4.3.12 baseline, developed by engineers with deep expertise in Moodle core and IOMAD.

A fix for every applicable Moodle vulnerability

HeroDevs is an authorized CVE Numbering Authority and discloses discovered vulnerabilities

Compliance

Once installed, scanners stop flagging Moodle or IOMAD 4.3 CVEs because the platform is actively patched and commercially supported, turning open audit findings into closed ones.

SOC 2, GDPR, NIS2, EU Cyber Resilience Act, HIPAA, ISO 27001, and more

Documented patch history for auditors

Business continuity

A true drop-in replacement. Same database schema, plugins, themes, and integrations, installed like a normal Moodle point upgrade. Schedule the move to 4.5 or 5.x between terms or certification cycles.

Months or years of runway to upgrade right

A fraction of the cost of a rushed upgrade or a breach

Why Teams Choose NES.

HeroDevs delivers CVE fixes at all severity levels with committed SLAs tied to severity, and is an authorized CVE Numbering Authority.

Community NGINX (retired branch)
Dedicated EOL Moodle support
Varies
CVE fixes by severity
CVE Numbering Authority (CNA)
Patch-delivery SLA
Drop-in replacement
Audit evidence
No commitment
Varies
With exceptions
Varies
Varies
HeroDevs logo
Purpose-built for Moodle 4.3 and IOMAD 4.3
All severity levels
Discovery and publication of CVEs
Committed
Standard Moodle layout, installs like a point upgrade
CVE-mapped release notes

Serious-Rated Vulnerabilities With No 4.3 Patch.

HeroDevs is an authorized CVE Numbering Authority (CNA), empowered by the CVE Program to discover and assign CVE IDs to security vulnerabilities discovered by HeroDevs.

If you're running EOL Moodle or IOMAD today, your applications are exposed to the vulnerabilities below.
17 CVEs affecting Moodle 4.3
Severity
CVE
Category
Version(s) Affected
Published Date
High
CVE-2026-58336
Authorization Bypass
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-62395
Incorrect Authorization
<4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
Low
CVE-2026-58335
Incorrect Authorization
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-54869
Denial of Service
<4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
Low
CVE-2025-67852
URL Redirect/Open Redirect
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2026-58334
Remote Code Execution
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-67851
Improper Neutralization of Special Elements
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2025-67850
Cross-Site Scripting
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2026-58333
Path Traversal
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Low
CVE-2025-49518
Authorization Bypass
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 14, 2026
High
CVE-2025-49517
Incorrect Authorization
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 14, 2026
Medium
CVE-2026-26047
Denial of Service
<4.5.9, >=5.0.0 <5.0.5, >=5.1.0 <5.1.2
Oct 14, 2026
High
CVE-2026-26046
Remote Code Execution
<4.5.9, >=5.0.0 <5.0.5, >=5.1.0 <5.1.2
Oct 14, 2026
Low
CVE-2025-62437
Incorrect Authorization
<4.1.20, >=4.2.0 <4.4.10, >=4.5.0 <4.5.6, >=5.0.0 <5.0.2
Oct 14, 2026
High
CVE-2026-26045
Remote Code Execution
<4.5.9, >=5.0.0 <5.0.5, >=5.1.0 <5.1.2
Oct 14, 2026
Low
CVE-2025-62436
Incorrect Authorization
<4.1.20, >=4.2.0 <4.4.10, >=4.5.0 <4.5.6, >=5.0.0 <5.0.2
Oct 14, 2026
Low
CVE-2026-7278
Cross-site Request Forgery
<4.5.11, >=5.0.0 <5.0.7, >=5.1.0 <5.1.4
Oct 14, 2026
Low
CVE-2026-7276
Denial of Service
<4.5.11, >=5.0.0 <5.0.7, >=5.1.0 <5.1.4
Oct 14, 2026
Medium
CVE-2025-62401
Incorrect Authorization
<4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
Medium
CVE-2025-62400
Information Exposure
<4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
High
CVE-2026-7275
Remote Code Execution
<4.5.11, >=5.0.0 <5.0.7, >=5.1.0 <5.1.4
Oct 14, 2026
High
CVE-2025-62399
Weak Authentication
<4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
High
CVE-2026-58332
Weak Authentication
>=4.3.0 <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-62398
Weak Authentication
>=4.3.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
High
CVE-2025-67848
Incorrect Authorization
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
Low
CVE-2026-58342
Cross-site Request Forgery
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
High
CVE-2026-7274
SQL Injection
<4.5.11, >=5.0.0 <5.0.7, >=5.1.0 <5.1.4
Oct 14, 2026
Low
CVE-2025-49516
Cross-site Request Forgery
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 14, 2026
High
CVE-2025-67847
Remote Code Execution
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
Low
CVE-2026-58341
Cross-site Request Forgery
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Low
CVE-2026-58348
Incorrect Authorization
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
High
CVE-2026-58347
Denial of Service
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Low
CVE-2026-58346
Server-Side Request Forgery
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-67857
Information Exposure
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2026-58345
Incorrect Authorization
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
High
CVE-2026-58340
Cross-Site Scripting
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-67856
Authorization Bypass
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
Low
CVE-2026-58339
Cross-Site Scripting
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
High
CVE-2026-58331
Path Traversal
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Low
CVE-2025-62438
Incorrect Authorization
<4.1.20, >=4.2.0 <4.4.10, >=4.5.0 <4.5.6, >=5.0.0 <5.0.2
Oct 14, 2026
Low
CVE-2026-58338
Cross-site Request Forgery
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-67855
Cross-Site Scripting
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2025-49515
Information Exposure
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 14, 2026
Low
CVE-2026-58337
Cross-site Request Forgery
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Low
CVE-2025-67854
Incorrect Authorization
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2025-67853
Weak Authentication
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2025-49514
Server-Side Request Forgery
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 14, 2026
Low
CVE-2025-49513
Information Exposure
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 14, 2026
Critical
CVE-2025-46337
SQL Injection
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 8, 2026
Load More
Severity
ID
Category
Version(s) Affected
Published Date
High
CVE-2026-58336
Authorization Bypass
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-62395
Incorrect Authorization
<4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
Low
CVE-2026-58335
Incorrect Authorization
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-54869
Denial of Service
<4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
Oct 14, 2026
Low
CVE-2025-67852
URL Redirect/Open Redirect
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2026-58334
Remote Code Execution
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Medium
CVE-2025-67851
Improper Neutralization of Special Elements
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2025-67850
Cross-Site Scripting
<4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
Oct 14, 2026
High
CVE-2026-58333
Path Traversal
<4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
Oct 14, 2026
Low
CVE-2025-49518
Authorization Bypass
<4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
Oct 14, 2026
Get Support
See Full Directory

Moodle 4.3 has not received a fix to any vulnerability since April 2025

Moodle 4.3 shipped in October 2023, received its final security release in April 2025, and then aged out. The backlog of CVEs and Security advisories grows and are not tested or fixed for v4.3.

Weaponized quickly

Unpatched CVEs can be exploited resulting on a breach or cyberattack.

An audit problem

Internal audits or  frameworks and regulation such as SOC 2, GDPR, NIS2, and the EU CRA require vulnerability-management controls. Unpatched CVEs fail compliance.

Upgrades take months

Moodle major upgrades could be complex.  For a heavily customized deployment, a 4.3 to 4.5 move is a project measured in months.

Multi-Tenant Moodle Is Covered Too.

IOMAD is the multi-tenant Moodle distribution, widely used by training providers, franchise operations, and corporate L&D teams that serve many client organizations from one platform. Because IOMAD is built directly on Moodle core, every Moodle core vulnerability above flows through to IOMAD 4.3.

A single IOMAD instance often hosts dozens of tenant organizations, so one unpatched remote code execution vulnerability has a multi-tenant blast radius: one compromise, many affected customers.

View Docs
White arrow

Reconciled against IOMAD core

Each Moodle 4.3 backport is reconciled against IOMAD's core modifications.

Same delivery, same evidence

The same delivery channel, the same CVE-mapped release notes, and the same drop-in compatibility with an existing IOMAD 4.3 deployment.

A defensible answer for every standard, framework, or regulation.

An end-of-life Moodle or IOMAD site undermines patch-management expectations across regulations worldwide. NES gives you a maintained, vendor-backed Moodle 4.3 with committed SLAs and CVE-mapped release notes to show auditors and regulators.

FERPA

US

Institutions must use reasonable methods to protect student education records. An LMS holding grades and enrollment data with no security patches is hard to defend. NES keeps Moodle 4.3 patched.

GDPR

EU

Article 32 expects "state of the art" technical measures. Running an unsupported Moodle holding learner personal data is difficult to defend after a breach. NES keeps the platform maintained.

SOC 2

Global

Trust Services Criteria expect timely vulnerability remediation and patch management. An EOL Moodle with no security patches translates to failing controls.

ISO/IEC 27001:2022

Global

Vulnerability and configuration management controls require addressing technical vulnerabilities. NES restores control posture with patch availability for Moodle 4.3.

Cyber Resilience Act

EU

Requires vulnerabilities in products and their components to be handled effectively during the support period. NES keeps Moodle and IOMAD components covered.

NIST CSF 2.0

US

PR.PS-02 requires organizations to maintain or remove vulnerable software based on risk. NES enables compliance without a forced upgrade.

UK GDPR & Cyber Essentials

UK

Cyber Essentials requires supported software with high and critical fixes applied within 14 days. NES puts Moodle 4.3 back in scope.

Commercial Contracts

Global

Corporate training and IOMAD tenants often contractually prohibit unsupported software. NES provides the vendor-backed answer their policies require.

Frequently Asked Questions

Is Moodle 4.3 still supported?
Does NES for Moodle 4.3 change my site or plugins?
Does NES cover IOMAD?
What about Moodle 4.1 and 4.4? They are EOL too.

Contact Us

Got questions about Never-Ending Support for your open-source library? We're here to help!

Discover how HeroDevs NES Products can keep your systems secure and compliant.

Learn how our solutions can deliver value to your organization.

Get detailed pricing information tailored to your needs.

Google logoLilly logoAbbott logoBox logoEG logoHitachi logoDropbox logoNHS logoWorkday logoFinra logoMicrosoft logoSantander logo
Talk to an Expert

By submitting the form I acknowledge receipt of our Privacy Policy.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Resources

View All Articles

Open Source Ecosystem

October 22, 2026

HeroDevs Reaffirms Commitment to Open Source Pledge for 2026 with $739K+ in Support

HeroDevs puts $739,137 back into open source in 2026, nearly $20,000per developer, funding ecosystems, maintainers and foundations.

Read more

EOL Software

October 15, 2026

Python End-of-Life Dates: Every Version's Support Timeline

A complete guide to Python version lifecycles, support phases, and critical end-of-life dates from 3.8 through 3.14

Read more

Migration

October 15, 2026

Upgrade or Buy Extended Support for an EOL Framework: How to Decide

Migration and extended support are not opposites. A simple framework for deciding which one fits your timeline.

Read more