Known exploited vulnerabilities
Drupal vulnerabilities attackers have used
Every Drupal vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 5 Drupal vulnerabilities as exploited in the wild, 1 of them added in the last 12 months and 2 used in ransomware campaigns. The most recent is CVE-2026-9082, added May 22, 2026. Core has the most entries (3).
- In KEV, all time
- 5
- Added, last 12 months
- 1
- Used in ransomware
- 2
- New CVEs this week
- 0
By product
Core (3), Drupal core (1), Drupal Core (1).
Every Drupal entry in CISA KEV
CVE-2026-9082
Added · dueDrupal Core SQL Injection Vulnerability
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
CVE-2019-6340
Added · dueDrupal Core Remote Code Execution Vulnerability
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
CVE-2020-13671
Added · dueDrupal core Un-restricted Upload of File
Improper sanitization in the extension file names is present in Drupal core.
Drupal Core Remote Code Execution Vulnerability
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.