Loxone Security Update: What Dublin Homeowners Need to Do Now

Loxone security has been in the news twice in four weeks: a cyberattack on Loxone's own company systems in October, and on 10 November a critical Miniserver update, version 17.3.11.10, that fixes a flaw letting the Miniserver be restarted over the network. If your Dublin home runs on Loxone, install the update now and check your remote access before 1 December 2026.

This post sets out what Loxone has said, what it means for a house in Dublin and the steps to take. The facts about Loxone below come from Loxone's statements and the reports we link to. If you would rather we did the work, see our Loxone Miniserver update service in Dublin.

The critical Miniserver update and Loxone security

On 10 November 2026 Loxone published a critical security update for the Miniserver. In its words, it discovered "a vulnerability that allows repeated restarts of the Miniserver to be triggered over the network". Loxone says this can affect the operation of the Miniserver, which may then not run the lighting, heating, blinds or door logic reliably, so this is not a cosmetic fix.

Three things go with the update:

• It is free and Loxone recommends updating all Miniservers immediately.
• Remote Connect is tighter. Anyone sending an unusually high number of connection requests to Miniservers is now blocked for a time.
• The web interface is off remotely. Until further notice the Miniserver web interface cannot be reached through Remote Connect. The Loxone App and Loxone Config still work remotely, and everything works as normal on the home network.

The October cyberattack on Loxone

The update follows an attack on Loxone itself. Loxone detected the intrusion into its internal company systems on 18 October 2026, isolated the systems and brought in outside forensic specialists. It said from the start that the Miniserver, Remote Connect and Exosphere were not affected. A Miniserver runs locally, with its user accounts stored on the device, so an attack on the company's office systems has no direct route into a house.

Data was taken, though. Loxone's management told the Austrian broadcaster ORF that customer data had been taken, and a ransomware group called SAMURAI claimed the attack, according to a Chiptron summary of 23 October. Loxone has said the data mainly covers partner contact details, support requests and job applicants, and that bank and card details were not affected.

For a Dublin homeowner the risk is indirect. Expect phishing emails that look genuine, perhaps mentioning your installer or your system. Loxone will never ask for your password by email, phone or text. And if your Miniserver password was ever typed into a support request or an email to an installer, change it.

Remote Connect changes on 1 December 2026

Separately from the security fix, Loxone has announced that its free Remote Connect service will require Miniserver version 17.2.10.21 or later from 1 December 2026. After that, each new Miniserver release gives four weeks to update before Remote Connect requires it.

If a Miniserver is left on an older version, Remote Connect stops brokering connections to it and Loxone Cloud DNS goes with it. The app would then only reach the house from outside through port forwarding on the router or a VPN, which is more work to set up and easier to get wrong. For most Dublin households, simply keeping the Miniserver current is the safer and simpler choice.

What to do in a Dublin Loxone home this month

A smart home system is easy to forget once it works. Some Loxone systems were fitted by firms that have since moved on, and some homeowners bought the house with Loxone already in place and never received the login. Loxone's own advice to new owners is to ask the seller for the access details and, if there are none, to get a partner to restore access, then set a new administrator password. We can take over systems like these, restore access and then update them.

Doing it yourself or getting help

If you have the administrator login, the update itself is done from Loxone Config or the Loxone App. The parts people skip are the backup, the password and user tidy up, and the check afterwards that every room still behaves. Those are the parts that matter most after a security incident.

Our Loxone Miniserver update service covers all of it. Where we can reach your Miniserver safely we often do it remotely, charged as remote support at €110 an hour plus VAT. Where a visit is needed it is €440 plus VAT for up to 4 hours, as in our smart home cost guide. Afterwards we can keep it current under 1Install Care, so you are never caught by the four week rule. More about our work in the city and county is on our Dublin page.

Questions we are often asked

Was my Loxone house hacked in October?

Loxone says the Miniservers in homes and buildings were not affected; the attack was on its own company systems. The data copied was mainly contact details, support requests and job applications.

Is the 17.3.11.10 update the same as the Remote Connect change?

No. 17.3.11.10 is the security fix released on 10 November 2026. The Remote Connect rule is separate: from 1 December 2026 the service needs version 17.2.10.21 or later, then each new version within four weeks.

Why can I not open my Miniserver's web page from outside the house?

Loxone has blocked the web interface through Remote Connect as a precaution until further notice. The Loxone App and Loxone Config still connect remotely.

Will the update change my lighting scenes or schedules?

It should not, but the Miniserver restarts during the update. Back up first and check the main rooms afterwards.

Can you update a Loxone system another company installed?

Yes. We take on systems installed by others and can restore access if the login has been lost.

Book a Loxone Miniserver update or call our Dublin office on 01 906 9326.