New CEO, clear AI ambition
Back in February, Magnolia appointed Dave Wilby as CEO. He followed a co-CEO phase; Alain Kugelmann moved back into the CFO role, and Samuel Staehelin took over product responsibility in addition to services. Wilby brings more than 25 years of experience at the intersection of engineering, product and corporate leadership. His mandate: to scale internationally and use AI in a way that relieves marketing and development teams operationally.
A second point of reference remains the Gartner Magic Quadrant for Digital Experience Platforms from January 2025. Magnolia was again placed there as a “Visionary”. What is publicly documented above all is Magnolia's composable positioning and its transparent pricing model. On the question of how the offering is developing compared to pure SaaS providers and how well developers are supported in customizing, a close look is still worthwhile.
Four building blocks for the agentic CMS
At NEXT 26, Magnolia structured its Agentic Release into four technical building blocks:
**Magnolia Dev MCP Server.** The toolkit brings Magnolia conventions into AI coding agents via skills files. For teams developing light modules or onboarding new colleagues, this can shorten ramp-up time. Our first trials point in this direction – but that is project experience, not a general performance promise.
**Doc-to-Page.** A document is turned into a structured Magnolia page with suitable components. This addresses a very practical editorial process: content is often prepared in Word or comparable tools and then manually rebuilt in the CMS.
**Vector Database.** Semantic and hybrid search via embeddings and context vectors is intended to make content easier to find and usable for retrieval scenarios. At the conference, this building block was explicitly presented as upcoming.
**Agentic Core.** This is where the actual orchestration lies: reasoning models, a three-tier security concept for tool calls, memory management and an MCP connection. With it, Magnolia showed how agents can use internal functions and external tools in a controlled way.
In addition, there was an outlook on more intent-based personalization. That was a future perspective, not a scheduled product commitment.
What shipped in July and August
On July 7, Magnolia 6.3.25 was released for the LTS line. The maintenance release focuses on cache behavior, editor reliability and backups. New features include cookie values in configurable cache keys; in addition, issues with CKEditor 5, asset previews and backup processes were fixed.
DX Core 6.4.8 followed on July 16. Since this release, building the GraphQL schema no longer fails completely because of a single faulty or unresolvable definition. Added were support for the separate Tier 2 incubator module GraphQL Solr, improvements to global search, and fixes for GraalVM 25 and SSO scenarios with custom 403 pages.
DX Core 6.4.9 was released on August 14. For large repositories, a performance fix is especially relevant: when sorting by publishing status, all matching nodes are no longer loaded. This resolves hangs that could occur with large asset inventories.
The logout behavior was also adjusted. Since 6.4.2, Magnolia has used the HTTP header `Clear-Site-Data`. Here, `cache` and `storage` only affect the Magnolia origin; `cookies`, on the other hand, can affect the entire registrable domain including subdomains. As of 6.4.9, `cache` is no longer sent by default, in particular to avoid long logout times in Chrome. If you have configured the directives individually or operate several applications under the same domain, you should check the `clearSiteDataDirectives` setting.
With 6.4.9, AI Accelerator 3.2.0 also became generally available. The two most visible new features are Agentic Chat as a conversational interface for agents and Doc-to-Page. This is an important step from conference demo to usable product – without implying that all four building blocks shown at NEXT have already been fully shipped.
A relevant security note
On August 10, CVE-2026-18478 was published. Affected were Magnolia CMS versions from 6.3.0 and before 6.3.10: a user with editor rights could trigger stored cross-site scripting via the name of an imported image. The vulnerability was already fixed in 6.3.10. If you run an older 6.3 version, you should therefore not only read the bulletin but update to a fixed version.
## What the development means for Magnolia
To the frequently discussed question of better support for developers, Magnolia gives an interesting answer with the Dev MCP Server: knowledge about conventions and best practices is to become available directly in the coding agent. This cannot fully replace documentation – architecture decisions, APIs and upgrade notes still need to be documented comprehensibly. As an additional access point to Magnolia knowledge, however, the approach is promising.
When it comes to the operating model, the picture remains nuanced. Magnolia offers DX Core for self-hosted use and DX Cloud as a platform-as-a-service. In June, the company also announced ENS certification at the High level for the Spanish market. For regulated organizations, this is relevant. Whether Magnolia thereby catches up in the SaaS comparison, however, depends heavily on the requirements of the respective company. For many customers in the DACH region, freedom of choice in hosting remains an advantage.
What will be interesting next
NEXT 26 also showed the future Visual Editor: live preview, inline editing, local undo/redo steps and integration via a new SDK. Magnolia described it as a future solution; I was unable to verify a reliable public delivery date.
Further future topics are the modernization of the administration interface, more API coverage, the Vector Database and intent-based personalization. Here, you should distinguish between the direction shown and the product already available.
My conclusion
This summer, Magnolia not only presented visions but delivered several concrete releases. 6.3.25 and 6.4.8 stabilize the foundation; 6.4.9 addresses performance problems in large repositories and brings AI Accelerator 3.2.0 with Agentic Chat and Doc-to-Page into general availability.
For project teams, this means: evaluate 6.4.9, check the logout configuration and test the AI Accelerator where a clear process benefit is recognizable. Doc-to-Page is particularly suitable for editorial teams that currently transfer a lot of content from documents. I would try out the Dev MCP Server with a manageable development case and measure whether quality and onboarding time actually benefit.
I am interested in how others experience this: is anyone already using Agentic Chat or Doc-to-Page in a real project? And what experiences have you had with the changed logout behavior?
