Drupal Core EUVD-2026-43081

Exploitation requires an active, authenticated session with Drupal administrator-level privileges (PR:H), meaning the attacker must have already obtained or compromised valid high-privilege credentials - standard user or editor accounts are insufficient. Beyond authentication, the High attack complexity rating (AC:H) indicates that additional specific conditions must be met, which may include particular Drupal module configurations, specific code execution pathways, or race conditions; the vendor advisory at https://www.drupal.org/sa-core-2026-005 should be consulted for the precise triggering configuration. The scope is unchanged (S:U), so impact is confined to the Drupal application itself and does not inherently pivot to the underlying OS or adjacent systems. Exploitation is limited by: requirement for high-privilege admin credentials; high attack complexity preconditions beyond authentication; and no confirmed public exploit or active campaigns in CISA KEV at time of analysis.

The CVSS 3.1 vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N yields a base score of 5.9, which accurately reflects the dual constraints of high attack complexity and required high-privilege (administrator-level) authentication. These two gating factors substantially limit the practical exploitation surface: an adversary must already control an admin account and satisfy additional complexity conditions - neither of which is trivially achievable. EPSS at 0.16% (6th percentile) is consistent with no observed mass exploitation, and the absence from the CISA KEV catalog corroborates this. The C:H/I:H impact sub-scores are legitimately severe should exploitation succeed, but the AC:H/PR:H prerequisites mean this is not broadly exploitable from the internet. This is not a 'patch everything immediately' scenario for organizations with sound privileged-account hygiene; however, Drupal sites running end-of-life 11.0.x or 11.1.x branches face compounded risk from the lack of ongoing security support. No conflict between CVSS signals and description is detected, but POC status is unconfirmed from available data.

An attacker who has obtained or compromised Drupal administrator credentials submits a crafted HTTP request to a vulnerable Drupal Core endpoint, injecting unexpected object attributes through the mass assignment pathway. If a suitable PHP gadget chain exists within the Drupal codebase or installed dependencies, the injected property values trigger unintended method calls during object processing, resulting in server-side code execution or unauthorized access to sensitive stored content. No public proof-of-concept has been identified at time of analysis, and the AC:H rating indicates that discovering or triggering the exact conditions requires non-trivial knowledge of the application internals.