/
← Voltar ao feed
high

CERT-FR: Multiple Drupal vulnerabilities allow remote code execution and XSS (CVE-2026-108097, -108514, -108515)

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 21:00 · coletado há 3 dias

CERT-FR advisory CERTFR-2026-AVI-1321, published 15 October 2026, reports multiple vulnerabilities in Drupal core that allow a remote attacker to execute arbitrary code and perform indirect code injection (XSS). The advisory references CVE-2026-108097, CVE-2026-108514 and CVE-2026-108515, based on three Drupal security bulletins dated 14 October 2026 (SA-CORE-2026-014, -015 and -016). It does not state whether any flaw is exploited in the wild, and gives no per-CVE technical detail, CVSS severity, IOCs or attribution.

Detalhes técnicos

  • Affected: Drupal 10.6.x before 10.6.19, 11.3.x before 11.3.19, and 11.4.x before 11.4.10.
  • Impact: remote arbitrary code execution and indirect remote code injection (XSS).
  • Vendor bulletins: SA-CORE-2026-014, SA-CORE-2026-015 and SA-CORE-2026-016.
  • The advisory does not map individual CVEs to specific impacts or state whether authentication is required.

Remediação

  • Consult the Drupal security bulletins and upgrade to the fixed versions: 10.6.19, 11.3.19 or 11.4.10, depending on the branch in use.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple Drupal vulnerabilities allow remote code execution and XSS (CVE-2026-108097, -108514, -108515)

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1321, published 15 October 2026, reports multiple vulnerabilities in Drupal core that allow a remote attacker to execute arbitrary code and perform indirect code injection (XSS). The advisory references CVE-2026-108097, CVE-2026-108514 and CVE-2026-108515, based on three Drupal security bulletins dated 14 October 2026 (SA-CORE-2026-014, -015 and -016). It does not state whether any flaw is exploited in the wild, and gives no per-CVE technical detail, CVSS severity, IOCs or attribution.

    Technical Details

    • Affected: Drupal 10.6.x before 10.6.19, 11.3.x before 11.3.19, and 11.4.x before 11.4.10.
    • Impact: remote arbitrary code execution and indirect remote code injection (XSS).
    • Vendor bulletins: SA-CORE-2026-014, SA-CORE-2026-015 and SA-CORE-2026-016.
    • The advisory does not map individual CVEs to specific impacts or state whether authentication is required.

    Remediation

    • Consult the Drupal security bulletins and upgrade to the fixed versions: 10.6.19, 11.3.19 or 11.4.10, depending on the branch in use.