diff --git a/_posts/2026-10-08-26.0.0-release.md b/_posts/2026-10-08-26.0.0-release.md
index 8d1ea38a79a..598756cc105 100644
--- a/_posts/2026-10-08-26.0.0-release.md
+++ b/_posts/2026-10-08-26.0.0-release.md
@@ -93,6 +93,12 @@ using `LoadFileSystemFactories`.
 
 ### Parquet
 
+#### CVE-2026-92287: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
+
+A security issue was fixed where KMS URLs embedded in Parquet files were forwarded to a user-implemented KMS client. This is now disabled by default but can be optionally enabled, in which case users should ensure they validate the KMS URLs received ([GH-51349](https://github.com/apache/arrow/issues/51349)).
+
+See our [separate announcement](https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57) for further detail.
+
 The schema nesting depth is now limited when parsing the Thrift metadata of a
 Parquet file, turning a stack overflow on pathologically nested schemas into a
 regular error ([GH-51238](https://github.com/apache/arrow/issues/51238)). The default limit (100) can be raised if needed.