Drupal Brute Force Attack Protection CVE-2026-11915

Exploitation requires a network-accessible Drupal installation with the 'Brute force attack protection' contributed module installed and active (non-default; must be explicitly added by the site administrator). The CVSS vector PR:H confirms that high-privilege Drupal credentials are a hard prerequisite - unauthenticated exploitation is not supported by the available data. AC:H indicates high attack complexity, implying specific preconditions or a non-trivial exploitation path beyond simple request crafting. Factors limiting exploitation: (1) the module must be explicitly installed - it is not part of Drupal core; (2) high-privilege account access is required; (3) high attack complexity per CVSS; (4) SSVC confirms the attack is not automatable. There is no indication of a specific configuration flag beyond module installation that enables or disables the vulnerable code path.

Real-world priority for this vulnerability is LOW to MODERATE despite the SSVC 'Technical Impact: total' rating. CVSS scores it at 5.9 Medium with PR:H (high privileges required) and AC:H (high complexity), which substantially constrains exploitability. EPSS at 0.15% (5th percentile) independently confirms near-zero observed exploitation probability. SSVC exploitation status is 'none' and automatable is 'no', further reducing urgency. There is a notable tension between the SSVC 'Technical Impact: total' rating and the CVSS C:H/I:H/A:N vector, which does not indicate total impact across all CIA dimensions - defenders should note this discrepancy and weight the CVSS vector as the more granular signal. No CISA KEV listing and no public POC are confirmed. The primary concern is for Drupal sites where this specific contributed module is installed AND where a highly privileged account has been compromised or is misused - a narrow threat model.

An attacker who has obtained high-privilege Drupal administrative credentials - through credential stuffing, phishing, or prior compromise - accesses the brute force protection module's configuration or administrative interface over the network. By exploiting the improper restriction flaw (CWE-307), the attacker manipulates or circumvents the module's authentication throttling, potentially enabling credential enumeration against other accounts or disclosing rate-limiting state that facilitates further attacks on the authentication system. No public POC is confirmed; this scenario is inferred from the CVSS vector and CWE classification.