Drupal Core EUVD-2026-43082

Exploitation requires an authenticated session with high Drupal privileges (PR:H per CVSS vector), meaning the attacker must first obtain admin-level Drupal credentials before the injection path is reachable. Attack complexity is rated High (AC:H), indicating the attacker must satisfy additional non-trivial conditions beyond authentication - likely crafting a specific object payload that maps to a gadget chain available in the Drupal codebase or its dependencies. No user interaction from a third party is required once the attacker holds the privileged session. Exploitation is limited to Drupal Core installations on the affected version branches; sites already running 10.5.12+, 10.6.11+, 11.2.14+, or 11.3.12+ are not affected. Externally exposed admin interfaces significantly increase real-world exposure, whereas sites with admin restricted to internal networks or VPN substantially reduce it.

Raw CVSS base score of 5.9 (Medium) is a reasonable representation of real-world risk here given the constraining metrics: AC:H means the attacker must meet non-trivial complexity conditions, and PR:H means they must already possess high-privilege (likely admin-level) Drupal credentials before exploitation. EPSS of 0.16% at the 6th percentile aligns with this high-barrier profile - the exploit surface is narrow and does not lend itself to mass automated scanning. No CISA KEV listing and no reported POC further reduce urgency. The C:H and I:H impact metrics remain serious if those pre-conditions are met, particularly for Drupal installations managing sensitive content or serving authenticated APIs. Defenders should treat this as a standard patch cycle priority for privileged-access hardened environments, but escalate response for environments where admin credentials are broadly shared, externally exposed admin interfaces exist, or where untrusted administrators are present (insider-threat scenarios).

An attacker who has obtained Drupal administrator credentials - through phishing, credential stuffing, or lateral movement - submits a specially crafted request to a privileged Drupal endpoint that passes attacker-controlled data into a dynamic object attribute assignment path. By injecting a malicious PHP object with a weaponized magic-method chain (e.g., __destruct leading to file write or system call), the attacker achieves code execution on the server under the web process account, then exfiltrates the database or site configuration. No public POC has been identified at time of analysis, so exploitation requires independent research or rediscovery.