diff --git a/.gitignore b/.gitignore
index 8bc92c8..8c1d2d3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,4 @@
 /mariadb-10.0.23.tar.gz
 /mariadb-10.0.24.tar.gz
 /mariadb-10.0.25.tar.gz
+/mariadb-10.0.26.tar.gz
diff --git a/mariadb-test-multi_update.patch b/mariadb-test-multi_update.patch
new file mode 100644
index 0000000..848aa90
--- /dev/null
+++ b/mariadb-test-multi_update.patch
@@ -0,0 +1,21 @@
+The warning is now being suppressed at the beginning of the test:
+CALL mtr.add_suppression("Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT.");
+
+--- mariadb-10.0.26/mysql-test/r/multi_update.result.orig	2016-06-23 11:24:42.000000000 +0200
++++ mariadb-10.0.26/mysql-test/r/multi_update.result	2016-07-28 08:55:18.440615246 +0200
+@@ -1054,7 +1054,6 @@ UPDATE IGNORE table_11757486 SET field1=
+ Warnings:
+ Warning	1264	Out of range value for column 'field1' at row 1
+ Warning	1264	Out of range value for column 'field1' at row 2
+-Note	1592	Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. UPDATE IGNORE is unsafe because the order in which rows are updated determines which (if any) rows are ignored. This order cannot be predicted and may differ on master and the slave.
+ UPDATE (SELECT 128 as col1) x, table_11757486 SET field1=x.col1;
+ ERROR 22003: Out of range value for column 'field1' at row 1
+ UPDATE table_11757486 SET field1=128;
+@@ -1068,7 +1067,6 @@ UPDATE IGNORE table_11757486 SET field1=
+ Warnings:
+ Warning	1264	Out of range value for column 'field1' at row 1
+ Warning	1264	Out of range value for column 'field1' at row 2
+-Note	1592	Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. UPDATE IGNORE is unsafe because the order in which rows are updated determines which (if any) rows are ignored. This order cannot be predicted and may differ on master and the slave.
+ DROP TABLE table_11757486;
+ SET SESSION SQL_MODE=default;
+ end of 10.0 tests
diff --git a/mariadb.spec b/mariadb.spec
index 134b702..483349b 100644
--- a/mariadb.spec
+++ b/mariadb.spec
@@ -112,11 +112,11 @@
 # Make long macros shorter
 %global sameevr   %{epoch}:%{version}-%{release}
 %global compatver 10.0
-%global bugfixver 25
+%global bugfixver 26
 
 Name:             mariadb
 Version:          %{compatver}.%{bugfixver}
-Release:          3%{?with_debug:.debug}%{?dist}
+Release:          1%{?with_debug:.debug}%{?dist}
 Epoch:            1
 
 Summary:          A community developed branch of MySQL
@@ -166,6 +166,7 @@ Patch32:          %{pkgnamepatch}-basedir.patch
 Patch34:          %{pkgnamepatch}-covscan-stroverflow.patch
 Patch36:          %{pkgnamepatch}-ssltest.patch
 Patch37:          %{pkgnamepatch}-notestdb.patch
+Patch38:          %{pkgnamepatch}-test-multi_update.patch
 
 BuildRequires:    cmake
 BuildRequires:    libaio-devel
@@ -504,6 +505,7 @@ MariaDB is a community developed branch of MySQL.
 %patch34 -p1
 %patch36 -p1
 %patch37 -p1
+%patch38 -p1
 
 # removing bundled cmd-line-utils is now disabled
 # we cannot use libedit due #1201988
@@ -1149,6 +1151,10 @@ fi
 %endif
 
 %changelog
+* Tue Aug  9 2016 Jakub Dorňák <jdornak@redhat.com> - 1:10.0.26-1
+- Rebase to 10.0.26
+  fixes for CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440
+
 * Thu Jul 21 2016 Jakub Dorňák <jdornak@redhat.com> - 1:10.0.25-3
 - use uname -n instead of hostname
   Resolves: #1317907
diff --git a/sources b/sources
index 5b6c8c5..ffcc41f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-647be2a9335b26a6f6dec7b7b52c7122  mariadb-10.0.25.tar.gz
+808f112b27f600ae844f54d0354e096e  mariadb-10.0.26.tar.gz