Drupal Core CVE-2026-15916

Exploitation requires network access to the Drupal site and user interaction (UI:R per CVSS vector) - the exact nature of which is not detailed in available data but likely constrains opportunistic exploitation. High attack complexity (AC:H) indicates the attacker must possess specific knowledge of protected URL paths or meet site-specific conditions rather than executing a generic payload against any Drupal instance. No authentication is required from the attacker (PR:N). Exploitation is limited to Drupal Core installations running the affected version ranges listed above; patched versions (10.6.13+, 11.3.14+, 11.4.4+) are not affected. The attack does not impact availability and yields only limited confidentiality and integrity exposure (C:L/I:L), meaning the attacker can read or modify restricted content but cannot achieve full system compromise. End-of-life branch users (11.0.x, 11.1.x, 11.2.x) face this condition with no official patch path.

The moderate CVSS score of 4.2 is consistent with the constrained vector: high attack complexity (AC:H) and required user interaction (UI:R) together suppress the practical exploitation rate well below what a raw network-reachable flaw would imply. EPSS at 0.13% (3rd percentile) independently corroborates low near-term exploitation probability, and CISA SSVC confirms exploitation status of none with the attack not automatable - meaning this vulnerability does not lend itself to mass scanning or worm-style propagation. The partial technical impact (C:L/I:L, A:N) further bounds the blast radius: even successful exploitation yields only limited read and write access, not full system compromise. The SSVC 'not automatable' designation is notable - it aligns with the AC:H constraint and suggests that exploitation requires attacker-specific knowledge of the target site structure. The wide version range affected (including multiple EOL branches still in broad use) modestly increases aggregate exposure across the Drupal ecosystem, but the low EPSS and SSVC signals together indicate this is a patch-on-schedule rather than an emergency out-of-band priority for most organizations. No KEV listing and no public proof-of-concept have been identified at time of analysis, so urgency is driven by hygiene and patch cadence rather than active threat response.

An attacker with knowledge of the target Drupal site's URL structure identifies a protected route that the authorization check fails to enforce, then directly requests that URL - potentially requiring some form of user interaction (such as a victim being logged in at the time, or the attacker enticing a browser-side action) due to the UI:R constraint. The high attack complexity suggests prior reconnaissance of site-specific paths or configuration is needed before a bypass attempt can succeed. No public proof-of-concept code has been identified at time of analysis.