Critical Drupal Core Vulnerability Requires Immediate Patching

Drupal has announced a highly critical vulnerability in its core system, urging users to prepare for a patch release on May 20, 2026. The vulnerability affects multiple versions, including unsupported branches 8.9 and 9.5, and could allow attackers to access non-public data and modify or delete content. The severity score is 20 out of 25, indicating ease of exploitation without privilege requirements. While known exploit methods are not yet available, the potential for rapid development of exploits exists. Users are advised to update to the latest supported release before the patch to mitigate additional risks. The Drupal Security Team emphasizes the urgency of this situation, as exploits could emerge within days of the patch release.

Key Points: • A critical vulnerability in Drupal core requires immediate patching by users. • The vulnerability affects multiple versions, including unsupported branches. • Drupal recommends updating to the latest supported release before the patch.