Drupal vulnerabilities in CISA KEV
Drupal has 5 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 45th highest of any vendor. 1 was added in the last 12 months; 2 are linked to known ransomware use (40% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 5 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Core, with 3 entries. Other frequently affected products: Drupal core (1); Drupal Core (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor drupal --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
5
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-05-22
most recent entry
┌─ last 12 months
1
entries added
┌─ ransomware use
2 of 5
40% linked to ransomware
┌─ distinct products
3
affected products
$ awk -F, {print $1} /var/log/kev/drupal.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 1 | 1 |
| 2022 | 3 | 1 |
| 2026 | 1 | 0 |
$ sort /var/log/kev/drupal.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Core 3 entries
- Drupal core 1 entry
- Drupal Core 1 entry
$ kev-due-dates --vendor drupal
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Drupal
21 days (range 5 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/drupal.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (4 of 5 have at least one CWE).
$ grep -ril 'Drupal' /var/log/news | head -5
Our reporting that names Drupal or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./drupal.kev · 5 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-9082
Core
Drupal Core SQL Injection Vulnerability
due 2026-05-27 · CWE-89
$ cat CVE-2026-9082.txt
Description. Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2018-7602
Core [RANSOMWARE]
Drupal Core Remote Code Execution Vulnerability
due 2022-05-04
$ cat CVE-2018-7602.txt
Description. A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
Required action. Apply updates per vendor instructions.
- CVE-2019-6340
Core
Drupal Core Remote Code Execution Vulnerability
due 2022-04-15 · CWE-502
$ cat CVE-2019-6340.txt
Description. In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
Required action. Apply updates per vendor instructions.
- CVE-2020-13671
Drupal core
Drupal core Un-restricted Upload of File
due 2022-07-18 · CWE-434
$ cat CVE-2020-13671.txt
Description. Improper sanitization in the extension file names is present in Drupal core.
Required action. Apply updates per vendor instructions.
- CVE-2018-7600
Drupal Core [RANSOMWARE]
Drupal Core Remote Code Execution Vulnerability
due 2022-05-03 · CWE-20
$ cat CVE-2018-7600.txt
Description. Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
Required action. Apply updates per vendor instructions.