Multiple vulnerabilities in Drupal (July 16, 2026)

unknownCVE-2026-15916 CVE-2026-55805 CVE-2026-15917

Multiple vulnerabilities have been discovered in Drupal. They allow an attacker to cause a breach of data confidentiality and a remote indirect code injection (XSS).

CSIRTS triage

vendor: Drupal product: Drupal Information disclosureOther

What: Multiple vulnerabilities allow an attacker to cause a breach of data confidentiality and a remote indirect code injection (XSS).
Who is affected: Users of Drupal are affected.
Urgency: Remediation is unknown urgency due to lack of specific details.
Action: Monitor for updates and apply patches when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Drupal

Get an email when a new Drupal advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-07-16
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0889/

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-15916	coverage & exploitation status	NVD · CVE.org
CVE-2026-55805	coverage & exploitation status	NVD · CVE.org
CVE-2026-15917	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[NEW] [medium] Drupal Core: Multiple vulnerabilitiescert-bund
criticalDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012drupal
criticalDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011drupal
criticalDrupal core - Moderately critical - Information disclosure - SA-CORE-2026-010drupal

Recent advisories for Drupal

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] Drupal (Token Content Access, Disable Login Page and Powerful Surveys): Multiple vulnerabilitie…cert-bund · 2026-07-30
medium[NEW] [medium] Drupal Modules: Multiple Vulnerabilitiescert-bund · 2026-07-23
high[NEW] [high] Drupal Modules: Multiple vulnerabilitiescert-bund · 2026-07-23
criticalDrupal security advisory (AV26-738)cccs · 2026-07-22
unknownDrupal plugin "AI Agents" vulnerable to incorrect authorizationjvn · 2026-07-21
medium[UPDATE] [medium] Drupal Extensions: Multiple vulnerabilitiescert-bund · 2026-07-20