Drupal security advisory (AV26-1047)
Canada's Cyber Centre warns of critical remote code execution in unpatched Drupal core releases.
The Canadian Centre for Cyber Security issued advisory AV26-1047 on October 15, 2026, warning that Drupal core is affected by vulnerabilities fixed in 11.4.10, 11.3.19, and 10.6.19. Drupal security advisory SA-CORE-2026-014 rates the issue critical and describes remote code execution. The bulletin, current as of October 14, does not cite a CVE or say the flaw is being exploited. Administrators are told to review Drupal's links and install the updates or apply suggested mitigations.
- Advisory AV26-1047 covers Drupal core as of October 14, 2026.
- Affected releases are before 11.4.10, 11.3.19, and 10.6.19.
- Drupal rates SA-CORE-2026-014 critical for remote code execution.
- The Cyber Centre urges administrators to apply the available updates.
- Vendors
- Drupal
- Products
- Drupal core
- Organizations
- Canadian Centre for Cyber SecurityDrupal
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1047 Date: October 15, 2026 As of October 14, 2026, Drupal is affected by vulnerabilities in the following product: Drupal core Prior to 11. 4. 10 Prior to 11.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.