Drupal Releases Emergency Core Patch Rated 'Highly Critical' — Zero-Auth Exploit Possible Within Hours

Drupal shipped an emergency core security update on May 20, 2026, covering all actively supported branches. The vulnerability is rated 20/25 on Drupal’s severity scale — “Highly Critical” — and requires zero authentication and zero access complexity to exploit. An unauthenticated remote attacker can achieve maximum impact to both Confidentiality and Integrity: arbitrary data access, modification, and deletion on the target site.

The Security Team deliberately withheld technical details during the scheduled patch window (17:00–21:00 UTC) to prevent exploit development before admins could respond. Their advisory stated explicitly: “exploits might be developed within hours or days of this announcement.” No CVE ID had been publicly assigned at the time of release.

Affected Versions

All sites running the following must update:

• Drupal 10.5.x → update to 10.5.x+1
• Drupal 10.6.x → update to 10.6.x+1
• Drupal 11.2.x → update to 11.2.x+1
• Drupal 11.3.x → update to 11.3.x+1

Back-ported patches are also available for the end-of-life 8.9 and 9.5 branches for sites that haven’t migrated. Drupal 7 is not affected.

How to Patch

Via Composer — the fastest path for most hosting setups:

composer update drupal/core
drush updb -y
drush cr

If you use Drupal’s admin UI, navigate to Manage → Reports → Available Updates and follow the update wizard. Sites on managed hosting (Pantheon, Acquia, Platform.sh) should check their dashboard for one-click update notifications pushed automatically by the platform.

Why Zero-Auth Is the Worst Case

A severity score this high with zero-authentication and zero-access-complexity prerequisites means no session token, no API key, no special role — just a network connection. The attack surface is every public-facing Drupal site on the internet. The combination of maximum Confidentiality and Integrity impact means attackers can read the database and write to it: extracting credentials, planting backdoors, or defacing content.

Drupal powers roughly 2.2% of all websites with known CMS, including government portals, universities, and enterprise intranets across the EU and US. At that scale, a zero-auth critical flaw draws automated scanners within hours of any public PoC.

The team’s advisory follows its emergency disclosure playbook: release a PSA days in advance, schedule a specific patch window, notify major host providers to pre-stage updates, then embargo technical details until the patch is live. That approach — debated in the community for creating uncertainty — has historically reduced the window between disclosure and widespread exploitation.

What You Should Do Right Now

1. Patch — run composer update drupal/core before reading the rest of this sentence.
2. Check logs for anomalous requests in the hours before you patched.
3. Review user accounts for unexpected admin role assignments.
4. If you manage client sites: treat this as P0, not a scheduled maintenance task.

The CVE ID and full technical disclosure will follow once the patch window closes and Drupal confirms broad adoption.