PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6367 Drupal CVE debrief

CVE-2026-6367 is a cross-site scripting (XSS) vulnerability in Drupal core affecting version 11.3.0 through versions before 11.3.7. The NVD record assigns a CVSS 3.1 score of 6.1 (Medium) and lists CWE-79. Because the vector includes network attack surface and user interaction, administrators should prioritize upgrading affected Drupal installations to 11.3.7 or later.

Vendor
Drupal
Product
Drupal core
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Drupal site owners, Drupal core maintainers, and security teams responsible for public-facing Drupal deployments should care most, especially where users can submit or view content that is rendered in the browser.

Technical summary

The official NVD metadata describes an Improper Neutralization of Input During Web Page Generation (CWE-79) issue in Drupal core. The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a network-reachable issue that requires user interaction and can affect confidentiality and integrity at low levels while not impacting availability. The vulnerable version range is from 11.3.0 before 11.3.7.

Defensive priority

Medium. This is a browser-side injection issue in a core web platform component, so affected internet-facing sites should treat it as a timely patching item even though the CVSS score is not critical.

Recommended defensive actions

  • Upgrade Drupal core to version 11.3.7 or later on all affected systems.
  • Inventory all Drupal instances and confirm whether any are running versions from 11.3.0 before 11.3.7.
  • Validate the upgrade in staging before production rollout, especially for custom themes, modules, and content-rendering paths.
  • Review the vendor advisory for any implementation-specific mitigation guidance.
  • Recheck exposed sites after remediation to confirm the vulnerable core version is no longer deployed.

Evidence notes

All substantive facts here come from the supplied NVD metadata and the referenced Drupal vendor advisory link. The source corpus states the affected range, CVSS vector, and CWE classification, and it references the Drupal advisory SA-CORE-2026-003. No exploit details or additional vulnerability mechanics are included in the supplied materials.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6367 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6367

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6367 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6367

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.