diff --git a/Doc/whatsnew/3.9.rst b/Doc/whatsnew/3.9.rst
index 004b3f34db750b6..453ddc80cda58bf 100644
--- a/Doc/whatsnew/3.9.rst
+++ b/Doc/whatsnew/3.9.rst
@@ -1726,14 +1726,17 @@ ssl
 ensurepip
 ---------
 
-* The bundled ``pip`` is upgraded from 23.0.1 to 26.0.1.post2, the ActiveState
+* The bundled ``pip`` is upgraded from 23.0.1 to 26.0.1.post3, the ActiveState
   security release of pip 26.0.1 (the last pip that supports Python 3.9).
   pip loads its own vendored ``certifi`` CA bundle in addition to the system
-  trust store; the bundle in 26.0.1.post2 (certifi 2026.10.23) drops the
+  trust store; the bundle in 26.0.1.post3 (certifi 2026.10.23) drops the
   emSign ECC Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3
   roots of the compromised eMudhra/emSign CA, leaving emSign Root CA - G1 as
   the only emSign root.  The release also patches CVE-2026-3219,
-  CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346.
+  CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346, and its vendored urllib3
+  (ActiveState 1.26.20.post4) fixes CVE-2025-50181, CVE-2025-66418,
+  CVE-2025-66471, CVE-2026-21441, CVE-2026-44431, CVE-2026-97687 and
+  CVE-2026-97689.
 * The bundled ``setuptools`` is upgraded from 79.0.1 to 82.0.1.post1, the
   ActiveState security release of setuptools 82.0.1 (the last setuptools that
   supports Python 3.9), fixing CVE-2026-59890.  setuptools removed
diff --git a/Lib/ensurepip/__init__.py b/Lib/ensurepip/__init__.py
index a3ed4b65c5669a1..8de3d6491182a4f 100644
--- a/Lib/ensurepip/__init__.py
+++ b/Lib/ensurepip/__init__.py
@@ -12,7 +12,7 @@
 
 __all__ = ["version", "bootstrap"]
 _SETUPTOOLS_VERSION = "82.0.1.post1"
-_PIP_VERSION = "26.0.1.post2"
+_PIP_VERSION = "26.0.1.post3"
 _PROJECTS = [
     ("setuptools", _SETUPTOOLS_VERSION, "py3"),
     ("pip", _PIP_VERSION, "py3"),
diff --git a/Lib/ensurepip/_bundled/pip-26.0.1.post2-py3-none-any.whl b/Lib/ensurepip/_bundled/pip-26.0.1.post3-py3-none-any.whl
similarity index 92%
rename from Lib/ensurepip/_bundled/pip-26.0.1.post2-py3-none-any.whl
rename to Lib/ensurepip/_bundled/pip-26.0.1.post3-py3-none-any.whl
index 08c026b8fb01b1e..3b1802d68a6cb60 100644
Binary files a/Lib/ensurepip/_bundled/pip-26.0.1.post2-py3-none-any.whl and b/Lib/ensurepip/_bundled/pip-26.0.1.post3-py3-none-any.whl differ
diff --git a/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip9.rst b/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip9.rst
index 7f21fe5ca498a3d..36931fc4013ebc8 100644
--- a/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip9.rst
+++ b/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip9.rst
@@ -1,6 +1,9 @@
 Upgrade the bundled pip in :mod:`ensurepip` to the ActiveState security
-release 26.0.1.post2 (the last pip that supports Python 3.9). Its vendored
+release 26.0.1.post3 (the last pip that supports Python 3.9). Its vendored
 certifi 2026.10.23 drops the emSign ECC Root CA - G3, emSign Root CA - C1 and
 emSign ECC Root CA - C3 roots of the compromised eMudhra/emSign CA
 (GHSA-6q48-6c7w-9gw2); emSign Root CA - G1 is the only emSign root left. It
-also patches CVE-2026-3219, CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346.
+also patches CVE-2026-3219, CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346,
+and vendors ActiveState's urllib3 1.26.20.post4, which fixes CVE-2025-50181,
+CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-44431,
+CVE-2026-97687 and CVE-2026-97689.