Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Drupal core allows remote code execution

CVE-2026-55803 · published 3 months ago
Summary

All supported versions of Drupal core up to 10.5.12, 10.6.11, and 11.3.12 are affected. An attacker could trick the site into creating objects with malicious data, potentially leading to unauthorized actions or full site takeover. Update Drupal core to the latest patched release as soon as possible.

What to do
  • Update drupal drupal/core to version 11.2.0.
  • Update drupal drupal core to version 10.5.12 or later.
Affected software
Ecosystem VendorProductAffected versions
Packagist drupal drupal/core >= 11.1.0, < 11.2.0
Fix: upgrade to 11.2.0
– drupal drupal core < 10.5.12
– drupal drupal < 10.5.12
>= 10.6.0, < 10.6.11
>= 11.0.0, < 11.2.14
>= 11.3.0, < 11.3.12
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Original advisory text
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published10 Jul 2026
Updated4 Nov 2026
First seen17 Jun 2026
Sources
DRUPAL-CORE-2026-005 · OSV
CVE-2026-55803 · NVD
CVE-2026-55803 · MITRE
CVE-2026-55803 · OSV
Track software like this
Free during beta