CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

[NEW] [high] Drupal Extensions: Multiple Vulnerabilities

highCVE-2026-16648CVE-2026-81163CVE-2026-84910CVE-2026-84911CVE-2026-84912CVE-2026-84913
A remote, anonymous attacker can exploit multiple vulnerabilities in various Drupal extensions to bypass access restrictions, disclose protected or sensitive content, take over user accounts, make unauthorized modifications or deletions, manipulate payment status, and conduct cross-site scripting attacks.

CSIRTS triage

product: Drupal ExtensionsAuthentication bypassInformation disclosureCode injectionCross-site scripting
What
Multiple vulnerabilities across various Drupal extensions allow remote anonymous attackers to bypass access controls, disclose protected content, take over accounts, make unauthorized modifications, manipulate payment status, and conduct XSS attacks.
Who is affected
Websites using affected Drupal extensions are at risk; anonymous attackers can exploit most vectors.
Urgency
High severity; multiple attack vectors including account takeover and payment manipulation require immediate patching.
Action
Identify and apply patches for all affected Drupal extensions listed in CVE-2026-16648, CVE-2026-81163, and CVE-2026-84910 through CVE-2026-84915.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Drupal Extensions

Get an email when a new Drupal Extensions advisory drops — max one per day, one-click unsubscribe.

Details

Source
CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity
high
Published
2026-09-03
Exploitation
Not in CISA KEV at last sync
Language
Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3168

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-16648coverage & exploitation statusNVD · CVE.org
CVE-2026-81163coverage & exploitation statusNVD · CVE.org
CVE-2026-84910coverage & exploitation statusNVD · CVE.org
CVE-2026-84911coverage & exploitation statusNVD · CVE.org
CVE-2026-84912coverage & exploitation statusNVD · CVE.org
CVE-2026-84913coverage & exploitation statusNVD · CVE.org
CVE-2026-84914coverage & exploitation statusNVD · CVE.org
CVE-2026-84915coverage & exploitation statusNVD · CVE.org
CVE-2026-84916coverage & exploitation statusNVD · CVE.org
CVE-2026-84917coverage & exploitation statusNVD · CVE.org
CVE-2026-84918coverage & exploitation statusNVD · CVE.org
CVE-2026-84919coverage & exploitation statusNVD · CVE.org
CVE-2026-84920coverage & exploitation statusNVD · CVE.org
CVE-2026-84921coverage & exploitation statusNVD · CVE.org
CVE-2026-84923coverage & exploitation statusNVD · CVE.org
CVE-2026-84924coverage & exploitation statusNVD · CVE.org

Recent advisories for Drupal Extensions

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from CERT-Bund (BSI) Security Advisories