Formatter Field CVE-2026-12535

Exploitation requires that the vulnerable Formatter Field module (version below 2.0.0) be installed and enabled on the target Drupal site, and that a request reach the field-formatting code path that improperly handles object attribute modification / deserialization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required against a reachable instance. A practical limiting factor for PHP object injection is the need for a usable POP gadget chain within the site's loaded codebase to convert object injection into meaningful impact; CISA's SSVC 'Automatable: no' rating further suggests exploitation is not readily scriptable at scale, implying non-trivial per-target conditions.

The signals here are notably in tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with total impact, which on paper is maximal severity. However, the corroborating exploitation signals are weak: EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, no public exploit was identified, and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact as 'total'. This combination - critical severity but low near-term exploitation likelihood - suggests a genuinely dangerous flaw that has not yet been weaponized. The 'Automatable: no' rating implies exploitation is not trivially scriptable at scale, which tempers the AC:L rating somewhat. Object injection exploitability in practice also depends on the presence of a usable POP gadget chain in the site's loaded code, a factor CVSS cannot capture. Treat this as an urgent patch for affected sites, but not necessarily a drop-everything mass-exploitation event as of this analysis.

An attacker sends a crafted HTTP request containing a malicious serialized PHP object to a Drupal site running a vulnerable Formatter Field version, where it is deserialized or used to set object attributes without validation. If a suitable gadget chain is present in the site's loaded code, the injected object triggers unintended method execution during its lifecycle, potentially yielding remote code execution or data compromise. No public proof-of-concept exploit has been identified at the time of analysis.