Vulnerability · Published Oct 30, 2026 · Assigned by drupal
CVE-2026-108097Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Unrated
In plain English
A security flaw in Drupal core from Drupal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS )–Not rated
Exploit odds (30 days)0.3%top 74.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | drupal/core | 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 | DRUPAL-CORE-2026-014 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal core | 8.9.0 – before 10.6.1911.0.0 – before 11.3.1911.4.0 – before 11.4.1012.0.0-alpha1 – before 12.0.0-beta2 |
Weakness: CWE-470