Drupal Cloud EUVD-2026-107825

Exploitation requires the attacker to occupy an Adversary-in-the-Middle position on the network path to the Drupal Cloud module and to present a certificate that the module's improper validation logic accepts; this MitM requirement is the primary limiting factor (reflected as AC:H) and means the flaw cannot be triggered by a purely remote off-path attacker. No authentication is required (CVSS PR:N) and no user interaction is needed. All Cloud versions from 0.0.0 up to the fix are affected; upgrading to version 7.0.1 remediates the issue. The available sources do not specify which exact TLS connection or endpoint is improperly validated.

This is a moderate-severity (CVSS 4.8), lower-priority issue by most signals. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) describes an unauthenticated network-reachable flaw but with high attack complexity and only low confidentiality/integrity impact and no availability impact - consistent with an Adversary-in-the-Middle (AiTM) class weakness where the attacker must already occupy a privileged network position. The EPSS score is very low (0.09%, 0th percentile), there is no CISA KEV listing, and no public exploit was identified, so there is no evidence of active or imminent widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the picture of a genuine but non-urgent fix. The signals are internally consistent: high complexity + low impact + near-zero EPSS + no KEV/PoC all point to a low real-world risk that warrants routine patching rather than emergency response. No conflicting signals were observed; the main limiting factor is the AC:H requirement for a MitM position.

An attacker positioned on the network path between a Drupal Cloud deployment and a remote endpoint (e.g., on shared or compromised network infrastructure, or via DNS/ARP manipulation) presents a fraudulent TLS certificate that the Cloud module fails to validate. Because certificate validation is improper, the attacker can intercept and potentially alter the TLS-protected traffic, exposing or tampering with transmitted data. No public exploit was identified at time of analysis, and the attack requires achieving the MitM position (reflected in AC:H).