Drupal vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 9 Drupal CVEs published between 2026-05-15 and 2026-08-15. The busiest month was 2026-08 (8 new CVEs). 1 of them (11%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 9 of 9 tracked Drupal CVEs.

• CVE-2026-9082critical 9.8KEVRansomwareEPSS 34.2%2026-05-20
• CVE-2026-55805medium 5.4EPSS 0.2%2026-08-25
• CVE-2026-18259high 7.5EPSS 0.1%2026-08-25
• CVE-2026-18260medium 5.7EPSS 0.1%2026-08-25
• CVE-2026-18261medium 5.7EPSS 0.1%2026-08-25
• CVE-2026-166432026-08-25
• CVE-2026-166442026-08-25
• CVE-2026-166452026-08-25
• CVE-2026-166462026-08-25

Products affected

Threadlinqs normalises CPE and CNA product records across all 9 CVEs; 8 distinct Drupal products are affected. The most frequently affected:

• core 2 CVEs
• Disable Login Page 1 CVE
• Lunr exposed filters 1 CVE
• PanKM 1 CVE
• PhotoSwipe - Responsive JavaScript Modal Image Gallery 1 CVE
• Powerful Surveys 1 CVE
• Token Content Access 1 CVE
• Webform REST 1 CVE

Threat activity

2 tracked threat campaigns reference Drupal products or exploit Drupal CVEs:

• CVE-2026-9082: Highly Critical Anonymous SQL Injection in Drupal Core PostgreSQL Entity Query Driver (SA-CORE-2026-004)CRITICAL2026-06-10
• Drupal Core Highly Critical SQL Injection in Database Abstraction API (PostgreSQL) — SA-CORE-2026-004 / CVE-2026-9082CRITICAL2026-05-21

How to prioritise Drupal patching

This order follows the data Threadlinqs holds for Drupal, not a generic severity checklist:

• 1 of 9 Drupal CVEs (11%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2026-9082.
• 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
• Outside KEV, the highest EPSS scores are CVE-2026-55805 (0.2%), CVE-2026-18259 (0.1%), CVE-2026-18260 (0.1%).
• 1 CVE scores Critical and 1 High on CVSS v3 (maximum 9.8, average 6.8); sequence these after KEV and high-EPSS items.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.