What is the CVSS score of CVE-2026-12535?

CVE-2026-12535 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Formatter Field are affected by CVE-2026-12535?

Any organization running Drupal websites with the Formatter Field module faces potential for complete application compromise via a critical object injection vulnerability (CVE-2026-12535) affecting…. A patch is available.

How to fix or mitigate CVE-2026-12535?

Within 24 hours, identify all Drupal instances running the Formatter Field module and document their current versions to establish scope of affected systems. Within 7 days, apply Drupal security update SA-CONTRIB-2026-048 to staging environments, complete functional testing of field formatting features, and validate the upgrade path to Formatter Field module version 2.0.0 or later. Within 30 days, deploy the patched module across all production Drupal instances, verify successful updates through the Drupal admin interface, and confirm completion via asset management records.

Formatter Field CVE-2026-12535

EUVD-2026-43051 CRITICAL

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-10 drupal

GHSA-qc2r-2xxp-m58x

Code Injection Drupal Formatter Field

9.8

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network, unauthenticated, no interaction with total impact, but AC:H because PHP object injection needs a viable gadget chain and CISA rates it not automatable.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:15 vuln.today

CVSS changed

Jul 13, 2026 - 19:07 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:43 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

AnalysisAI

Object injection in the Drupal Formatter Field contributed module (all versions from 0.0.0 up to but not including 2.0.0) allows remote unauthenticated attackers to improperly modify dynamically-determined object attributes, potentially leading to arbitrary code execution or full site compromise. The flaw carries a CVSS 9.8 rating, but with no public exploit identified and a low EPSS probability (0.17%, 7th percentile), and SSVC currently rates exploitation as 'none'. A vendor patch is available via Drupal advisory SA-CONTRIB-2026-048.

Technical ContextAI

Formatter Field is a contributed module for the Drupal CMS ecosystem (CPE cpe:2.3:a:drupal:formatter_field), used to render and format field output within Drupal sites. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), a class of bug where untrusted input is allowed to set or alter object properties that were not intended to be attacker-controllable. In PHP applications like Drupal this commonly manifests as PHP Object Injection, typically via unsafe deserialization (unserialize()) or dynamic property assignment, enabling an attacker to instantiate or manipulate objects whose magic methods (__wakeup, __destruct) trigger unintended code paths (POP gadget chains).

RemediationAI

Upgrade the Formatter Field module to version 2.0.0 or later, which is the first fixed release (the advisory notes the vulnerable range is 0.0.0 up to but not including 2.0.0); a patch is confirmed available per Drupal advisory SA-CONTRIB-2026-048 at https://www.drupal.org/sa-contrib-2026-048. If immediate upgrade is not possible, disable and uninstall the Formatter Field module to remove the vulnerable code path, accepting that any field formatting functionality it provides will be lost until it can be restored on a patched version. As a compensating control pending patching, restrict network access to the affected Drupal site and place a web application firewall in front of it to inspect and block serialized-object payloads in requests reaching field-formatter endpoints, recognizing that WAF signatures for object injection are imperfect and may be bypassed. Review the exact fixed release listed on the linked Drupal advisory before deploying.