Drupal Raw Formatter CVE-2026-15086

Exploitation requires an authenticated session with high-privilege Drupal permissions (PR:H per CVSS), limiting the attack to users with administrator-level or elevated content/configuration roles. Additionally, high attack complexity (AC:H) implies a specific precondition must be met - likely a particular module configuration state, content type setup, or field formatter assignment - before the vulnerability is reachable. Scope is unchanged (S:U), confirming impact is confined within the Drupal application. What limits exploitation: the dual barrier of high authentication privilege and high attack complexity makes this unsuitable for unauthenticated or low-skill opportunistic attacks; exploitation is further constrained to environments where the Raw Formatter [Meta Tag Formatter] module is actively installed and configured. No special network position (AV:N) is required beyond standard web access to the Drupal instance once authentication is obtained.

The overall real-world risk is moderate-to-low despite the CVSS impact metrics. CVSS scores this at 5.9 (Medium), driven by AV:N/AC:H/PR:H - meaning exploitation requires both high-privilege authentication and a complex precondition, two compounding barriers that substantially reduce the exploitable population. EPSS at 0.24% (15th percentile) reinforces that automated or opportunistic exploitation is unlikely. SSVC independently rates exploitation as 'none' and automatable as 'no,' consistent with the AC:H/PR:H CVSS vector. The SSVC 'Technical Impact: total' rating reflects the potential C:H/I:H outcome if reached, but this should not inflate priority given the prerequisites. There is no KEV listing and no public exploit code. The primary concern is a privileged insider or compromised admin account abusing the module's raw output capability - a scenario relevant mostly to multi-tenant or high-sensitivity Drupal deployments. Note: the CVE description field is incomplete (truncated to 'allows .'), so the precise exploitation mechanism is unconfirmed from NVD data alone; the Drupal advisory SA-contrib-2026-077 is the authoritative source.

A high-privilege Drupal user - such as an administrator or a role with module configuration access - navigates to a Raw Formatter-managed content field or meta tag configuration endpoint and triggers a complex precondition (AC:H) that causes the module to expose or modify protected content. Given PR:H and AC:H, the most realistic scenario is an insider threat or session hijacking of an admin account rather than opportunistic external attack. No public exploit code exists at time of analysis.