Drupal Core CVE-2026-15917

User interaction is mandatory - the victim must browse to a page rendering the malicious payload (CVSS UI:R confirmed). The AC:H metric indicates a specific Drupal Core component, content field type, rendering context, or configuration is required to trigger the vulnerability; generic content submission paths are unlikely to be universally exploitable. No attacker authentication is required (PR:N). Impact is bounded to the victim's browser context: confidentiality impact is limited (session token theft possible) and integrity impact is limited (page content manipulation); server availability is not affected. Sites running only Drupal 11.3.x or 11.4.x are affected - installations on supported 11.2.x or older branches without upgrade paths face unpatched exposure. The specific Drupal module, field formatter, or theme function responsible for the insufficient neutralization is not identified in available data.

All available signals indicate low urgency. The CVSS 3.1 base score of 4.7 (Medium) reflects three material constraints: high attack complexity (AC:H), mandatory user interaction (UI:R), and limited impact ceiling (C:L/I:L/A:N). EPSS at 0.15% places this in the 4th percentile - the large majority of CVEs carry higher exploitation probability. SSVC further confirms exploitation status as 'none' and automatable as 'no,' ruling out mass automated attack campaigns. There is no CISA KEV listing and no public exploit code identified at time of analysis. The scope change is the primary risk amplifier: successful exploitation enables session token exfiltration or client-side action forgery, which could be leveraged against privileged Drupal users such as site administrators or editors. For sites handling sensitive data or granting broad editorial permissions, patching should be scheduled promptly; for others, this falls into routine patch-cycle remediation rather than emergency response.

An attacker identifies a Drupal site running a vulnerable 11.x release and locates a content input path - such as a node body, field, or view - that is rendered without adequate output encoding. The attacker submits a crafted XSS payload through that path, then lures an authenticated Drupal user (ideally an editor or administrator) to load the affected page, causing the payload to execute in the victim's browser, capturing session cookies or performing privileged site actions on the victim's behalf. No public exploit code exists at time of analysis, and the AC:H rating indicates the attacker must first identify the specific vulnerable rendering context, limiting opportunistic mass exploitation.