Drupal Block AJAX CVE-2026-107249

Exploitation requires reaching the Block AJAX module's AJAX request-handling path with attacker-influenced data that feeds unsafe object/attribute modification; the module must be installed and enabled on the Drupal site, and the site must be running an affected version (anything below 3.0.2). The available sources do not state whether a specific Drupal permission, authenticated session, or non-default configuration is needed to reach the vulnerable callback, so the PR:N (unauthenticated) assumption is not confirmed and is a key limiting factor to verify. Successful object injection also typically depends on a usable gadget chain being present in the loaded codebase. Upgrading to Block AJAX 3.0.2 is the vendor-provided fix.

Signals conflict and should be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8) describes a remotely reachable, low-complexity flaw with total impact, and the vuln.today Decision label is 'act_now', which argues for prompt remediation. Against that, the EPSS score is only 0.19% (9th percentile), indicating a low modeled probability of exploitation in the near term, and there is no CISA KEV listing - so the status is 'no public exploit identified at time of analysis'. The high CVSS is consistent with the CWE-915 object-injection class (PHP object injection in Drupal can escalate to code execution via gadget chains), but the available sources do not describe how the flaw is triggered, so the PR:N assumption is not independently confirmed - if the vulnerable AJAX callback requires a Drupal permission, the realistic privilege requirement is higher than the vector states. Net: treat as a genuine priority because a vendor patch exists, the Decision label is act_now, and the impact class is code-execution-capable, but note the low EPSS suggests no widespread automated exploitation is occurring yet.

A remote attacker submits a crafted request to the Block AJAX module's request-handling endpoint containing attacker-controlled data that is deserialized or used to set object attributes, triggering PHP object injection (CWE-915). Via an available gadget chain this can lead to high-impact compromise of the Drupal site. No public exploit code was identified in the provided sources, and the exact trigger is not described in the available sources.