{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/drupal-10.6.x--10.6.19/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Drupal (10.6.x \u003c 10.6.19)","Drupal (11.3.x \u003c 11.3.19)","Drupal (11.4.x \u003c 11.4.10)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Drupal"],"content_html":"\u003cp\u003eThe French National Cybersecurity Agency (ANSSI) has issued an advisory regarding multiple critical vulnerabilities discovered in the Drupal content management system. These vulnerabilities, documented in security bulletins SA-CORE-2026-014, SA-CORE-2026-015, and SA-CORE-2026-016, expose affected instances to remote code execution (RCE) and reflected cross-site scripting (XSS) attacks.\u003c/p\u003e\n\u003cp\u003eThe scope includes Drupal versions 10.6.x before 10.6.19, 11.3.x before 11.3.19, and 11.4.x before 11.4.10. CVEs identified for these issues include CVE-2026-108097, CVE-2026-108514, and CVE-2026-108515. Given the potential for unauthenticated remote code execution, organizations deploying Drupal must verify their current version and apply the vendor-provided patches immediately to mitigate the risk of system compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities could result in full site compromise through remote code execution, potentially leading to unauthorized data exfiltration, lateral movement within the network, or the injection of malicious scripts into user sessions via XSS. The number of affected instances is potentially high given the prevalence of Drupal in enterprise content management environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize the update of all Drupal instances to the latest secure versions as identified in the referenced security bulletins (SA-CORE-2026-014, SA-CORE-2026-015, and SA-CORE-2026-016).\u003c/li\u003e\n\u003cli\u003eUpgrade Drupal 10.6.x instances to 10.6.19 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade Drupal 11.3.x instances to 11.3.19 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade Drupal 11.4.x instances to 11.4.10 or later.\u003c/li\u003e\n\u003cli\u003eMonitor web application firewall logs for unusual HTTP POST requests or suspicious parameters that may indicate attempts to exploit RCE or XSS vectors targeting the core Drupal endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T16:26:25Z","date_published":"2026-10-15T16:26:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-drupal-vulnerabilities/","summary":"Multiple vulnerabilities, including remote code execution and cross-site scripting, affect Drupal versions 10.6.x, 11.3.x, and 11.4.x, requiring immediate patching to prevent unauthorized code execution.","title":"Multiple Vulnerabilities in Drupal Core","url":"https://feed.craftedsignal.io/briefs/2026-10-drupal-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Drupal (10.6.x \u003c 10.6.19)","version":"https://jsonfeed.org/version/1.1"}