Drupal security advisory (AV26-1047)
Canada's Cyber Centre warns of critical remote code execution in unpatched Drupal core releases.
The Canadian Centre for Cyber Security issued advisory AV26-1047 on October 15, 2026, warning that Drupal core is affected by vulnerabilities fixed in 11.4.10, 11.3.19, and 10.6.19. Drupal security advisory SA-CORE-2026-014 rates the issue critical and describes remote code execution. The bulletin, current as of October 14, does not cite a CVE or say the flaw is being exploited. Administrators are told to review Drupal's links and install the updates or apply suggested mitigations.
- Advisory AV26-1047 covers Drupal core as of October 14, 2026.
- Affected releases are before 11.4.10, 11.3.19, and 10.6.19.
- Drupal rates SA-CORE-2026-014 critical for remote code execution.
- The Cyber Centre urges administrators to apply the available updates.
- Vendors
- DrupalProgressSchneider ElectricMoxaF5Johnson ControlsSonicWallHewlett Packard EnterpriseSUSEJetBrainsGoogleMozilla
- Products
- Drupal coreMOVEit TransferSage RTUAIG-302 SeriesNGINXNGINX Gateway FabricNGINX Ingress ControllerNGINX PlusNGINX Instance ManagerF5 WAF for NGINXF5 DoS for NGINXAmerican Dynamics ADVMS
- Organizations
- Canadian Centre for Cyber SecurityDrupalProgressF5Johnson ControlsHewlett Packard EnterpriseSUSEMozilla
- Countries
- Canada
Coverage
oldest first · one row per article · UTC- · 10d ago
Canadian Centre for Cyber SecurityFirst report
HPE security advisory (AV26-1046)
Canada's Cyber Centre urges patches for HPE NonStop, iLO, and AOS-Switch flaws.
- · 10d ago
Drupal security advisory (AV26-1047)
Canada's Cyber Centre warns of critical remote code execution in unpatched Drupal core releases.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101019 | njs XML entity attributes bypass nginx-saml checks | 8.3 | — | ||
| CVE-2026-104939 | Auth bypass in F5 NGINX Ingress Controller externalAuth | 8.7 | — | ||
CVE-2026-109813+1 related CVE | Hard-coded key in Moxa sysman (adjacent network) | 8.6 group max | — | ||
| CVE-2026-15176 | NGINX heap overflow via alias and $request_filename | 9.2 | — |