Drupal Core CVE-2026-6365

Exploitation requires that a victim user with an active Drupal session interacts with attacker-controlled content - specifically, the victim must visit or trigger a crafted page or URL (UI:R in CVSS). The attacker requires no authentication (PR:N) and no special system access (AV:N, AC:L), meaning any internet-based attacker can attempt to deliver the payload. Exploitation is limited by the mandatory user interaction step: fully automated, hands-off exploitation without victim participation is not possible. The highest-impact scenario targets authenticated users, particularly those with administrative roles, as their session context provides broader site control. No specific non-default configuration or feature flag is documented as a prerequisite - the vulnerability appears to affect core page generation in standard deployments across all affected version ranges.

The CVSS base score of 6.1 (Medium) reflects moderate real-world impact bounded by the User Interaction Required (UI:R) constraint, which prevents fully automated exploitation. The low complexity (AC:L) and no-privileges-required (PR:N) factors mean any unauthenticated remote attacker can craft an exploit without special knowledge or credentials, lowering the skill barrier. The Changed Scope elevates the potential impact beyond the immediate victim. However, the EPSS score of 0.03% at the 8th percentile is notably low, suggesting the security community does not currently assess this as a likely near-term exploitation target. There is no CISA KEV listing and no reported POC, further reducing urgency for most organizations. The primary real-world risk is opportunistic phishing campaigns delivering crafted Drupal URLs to authenticated users, particularly administrators, to hijack privileged sessions. The breadth of affected versions (8.0.0 through 11.3.6) means a large fraction of unpatched Drupal deployments are potentially vulnerable, though EPSS data does not indicate active scanning or exploitation at this time.

An attacker identifies a publicly accessible Drupal site running a vulnerable version and crafts a URL containing a malicious JavaScript payload targeting the vulnerable rendering component. The attacker delivers this link to an authenticated Drupal administrator via a phishing email or forum post; when the administrator clicks the link and the page renders, the injected script executes in the administrator's browser, exfiltrating session cookies or performing privileged actions on the site under the administrator's identity. No public POC has been identified at time of analysis, meaning this scenario currently requires attacker-side development of exploit code.