[UPDATE] [critical] Drupal Core: Multiple vulnerabilities

criticalpublic exploitCVE-2026-55803 CVE-2026-55804 CVE-2026-55806 CVE-2026-55807 CVE-2026-55808 CVE-2019-6340

An attacker can exploit multiple vulnerabilities in Drupal Core to execute arbitrary code, conduct cross-site scripting attacks, manipulate data, or redirect users to malicious websites.

CSIRTS triage

vendor: Drupal product: Drupal Core Remote code execution Cross-site scriptingOther

What: Multiple vulnerabilities in Drupal Core allow an attacker to execute arbitrary code, conduct cross-site scripting attacks, manipulate data, or redirect users to malicious websites.
Who is affected: Deployments of Drupal Core are affected by these vulnerabilities.
Urgency: Remediation is urgent due to the critical severity and confirmed exploitation of these vulnerabilities.
Action: Apply the latest security updates provided by Drupal.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Drupal Core

Get an email when a new Drupal Core advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: critical
Published: 2026-07-13
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2002

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-558030.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
Low exploitation riskCVE-2026-558040.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
Low exploitation riskCVE-2026-558060.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
Low exploitation riskCVE-2026-558070.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.
Low exploitation riskCVE-2026-558080.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Exploitation likely imminentCVE-2019-6340EPSS puts this in the most-targeted tier (92.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-55803	coverage & exploitation status	NVD · CVE.org
CVE-2026-55804	coverage & exploitation status	NVD · CVE.org
CVE-2026-55806	coverage & exploitation status	NVD · CVE.org
CVE-2026-55807	coverage & exploitation status	NVD · CVE.org
CVE-2026-55808	coverage & exploitation status	NVD · CVE.org
CVE-2019-6340	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Drupal Core

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] Drupal Core: Multiple vulnerabilitiescert-bund · 2026-07-16
criticalDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012drupal · 2026-07-15
criticalDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011drupal · 2026-07-15
criticalDrupal core - Moderately critical - Information disclosure - SA-CORE-2026-010drupal · 2026-07-15
mediumCVE-2026-55808: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerabi…nvd · 2026-07-10
lowCVE-2026-55807: Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Requ…nvd · 2026-07-10