HIGH CWE-470
CVE-2026-108097
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Drupal·core
8.1/ 10
CVSS 3.1
High severity
0.57%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 48% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Oct 30, 2026
- Updated
- Nov 6, 2026
- First covered
- Oct 18, 2026
- Latest story
- 2 weeks ago
Summary
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Attack profile
Attack vectorNetwork
ComplexityHigh
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
- Drupal core8.9.0 to before 10.6.1911.0.0 to before 11.3.1911.4.0 to before 11.4.1012.0.0-alpha1 to before 12.0.0-beta2