Multiple Vulnerabilities in Drupal Core

The French National Cybersecurity Agency (ANSSI) has issued an advisory regarding multiple critical vulnerabilities discovered in the Drupal content management system. These vulnerabilities, documented in security bulletins SA-CORE-2026-014, SA-CORE-2026-015, and SA-CORE-2026-016, expose affected instances to remote code execution (RCE) and reflected cross-site scripting (XSS) attacks.

The scope includes Drupal versions 10.6.x before 10.6.19, 11.3.x before 11.3.19, and 11.4.x before 11.4.10. CVEs identified for these issues include CVE-2026-108097, CVE-2026-108514, and CVE-2026-108515. Given the potential for unauthenticated remote code execution, organizations deploying Drupal must verify their current version and apply the vendor-provided patches immediately to mitigate the risk of system compromise.

Impact

Successful exploitation of these vulnerabilities could result in full site compromise through remote code execution, potentially leading to unauthorized data exfiltration, lateral movement within the network, or the injection of malicious scripts into user sessions via XSS. The number of affected instances is potentially high given the prevalence of Drupal in enterprise content management environments.

Recommendation

• Prioritize the update of all Drupal instances to the latest secure versions as identified in the referenced security bulletins (SA-CORE-2026-014, SA-CORE-2026-015, and SA-CORE-2026-016).
• Upgrade Drupal 10.6.x instances to 10.6.19 or later.
• Upgrade Drupal 11.3.x instances to 11.3.19 or later.
• Upgrade Drupal 11.4.x instances to 11.4.10 or later.
• Monitor web application firewall logs for unusual HTTP POST requests or suspicious parameters that may indicate attempts to exploit RCE or XSS vectors targeting the core Drupal endpoints.