Drupal flaws being used in attacks

CISA lists 5 flaws in Drupal products as being used in attacks, most recently on 22 May 2026. 2 have been used in ransomware.

What to do

1. Update every Drupal product you use.Install the updates Drupal offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 22 May 2026
   Drupal Core
   CVE-2026-9082Drupal Core SQL Injection Vulnerability
   Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
2. Being used in attacksUsed in ransomwareAdded by CISA on 13 Apr 2022
   Drupal Core
   CVE-2018-7602Drupal Core Remote Code Execution Vulnerability
   A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 25 Mar 2022
   Drupal Core
   CVE-2019-6340Drupal Core Remote Code Execution Vulnerability
   In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 18 Jan 2022
   Drupal core
   CVE-2020-13671Drupal core Un-restricted Upload of File
   Improper sanitization in the extension file names is present in Drupal core.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
5. Being used in attacksUsed in ransomwareAdded by CISA on 3 Nov 2021
   Drupal Core
   CVE-2018-7600Drupal Core Remote Code Execution Vulnerability
   Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Drupal on CISA’s site.