What is the CVSS score of CVE-2026-15086?

CVE-2026-15086 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Drupal Raw Formatter CVE-2026-15086

EUVD-2026-43089 MEDIUM

2026-07-10 drupal

GHSA-vxww-4cjp-32x4

Information Disclosure Drupal Raw Formatter Meta Tag Formatter

5.9

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.9 MEDIUM

PR:H confirmed by privilege-gated Drupal module access; AC:H reflects specific configuration precondition; no availability impact identified.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:31 vuln.today

CVSS changed

Jul 13, 2026 - 20:22 NVD

5.9 (MEDIUM)

CVE Published

Jul 10, 2026 - 21:57 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

AnalysisAI

High-privilege network exploitation of the Drupal Raw Formatter [Meta Tag Formatter] contributed module leads to high confidentiality and integrity impact across all released versions. The vulnerability requires an authenticated user with elevated Drupal permissions and high attack complexity (PR:H, AC:H per CVSS), significantly narrowing the realistic attack surface despite the notable C:H/I:H impact rating. No public exploit has been identified at time of analysis, EPSS sits at 0.24% (15th percentile), and SSVC confirms exploitation status as none - consistent with a narrow, privilege-dependent flaw in a niche contrib module rather than a broadly weaponizable issue.

Technical ContextAI

Raw Formatter [Meta Tag Formatter] is a Drupal contributed module that exposes raw meta tag output - likely rendering field or entity data without standard Drupal sanitization or access controls. The affected CPE (cpe:2.3:a:drupal:raw_formatter_[meta_tag_formatter]:*:*:*:*:*:*:*:*) covers all versions, suggesting the flaw is architectural rather than a regression. No CWE identifier has been assigned, leaving the root cause class unconfirmed; however, the 'Information Disclosure' tag combined with C:H/I:H CVSS impact metrics and the module's name suggest the vulnerability may involve improper output rendering or insufficient access control around raw meta tag data. The CVSS Scope:Unchanged metric (S:U) indicates the impact is contained within the Drupal application boundary.

RemediationAI

Consult the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-077 for the official fix - a specific patched version number is not confirmed in available data, so the patch availability status should be verified directly with Drupal's security team before assuming a release exists. If an update is not yet available or cannot be applied immediately, the most targeted compensating control is to restrict access to the Raw Formatter [Meta Tag Formatter] module's administrative permissions to the minimum necessary trusted roles within Drupal's permission system, or to disable the module entirely if raw meta tag output is not required by the site. Disabling the module eliminates the attack surface entirely but may affect dependent content display features. Monitor https://www.drupal.org/sa-contrib-2026-077 for patch release announcements.