Drupal core reflection injection enables unauthenticated remote code execution (CVE-2026-108097)

What happened

Drupal core contains an unsafe reflection weakness (CWE-470). When an attacker can influence input that later selects classes or code, the application may interpret that input in a way the developer did not intend, allowing the wrong code path to be loaded or instantiated. The CVSS vector classifies this as network-reachable, requiring no privileges and no user interaction, although exploitation is not automatic: attack complexity is high. Successful exploitation carries high impact for confidentiality, integrity and availability, meaning an attacker could execute code in the context of the web server or PHP process running Drupal.

There is currently no stated active exploitation. The CVE record marks exploitation as none, the flaw is absent from CISA's KEV catalogue, and no public exploit disclosure is recorded. Drupal's security advisory does not mention observed attacks.

Who is affected

Affected releases are Drupal core 8.9.0 to before 10.6.19, Drupal core 11.0.0 to before 11.3.19, Drupal core 11.4.0 to before 11.4.10, and Drupal core 12.0.0-alpha1 to before 12.0.0-beta2. Drupal core typically runs public and internal websites, portals and e-commerce platforms; it holds user accounts, content, and often administrative credentials, which makes remote code execution here a high-impact event for the whole hosting environment.

What to do now

1. Identify which Drupal core branch and exact version you are running.
2. Update Drupal core to the fixed release in that branch: 10.6.19, 11.3.19, 11.4.10, or 12.0.0-beta2.
3. Use Drupal's status report and your normal test process to confirm the update is applied and that public-facing forms, modules and extensions still work as expected.

Drupal's advisory does not document a workaround, so upgrade is the primary mitigation. If you must delay patching, restrict network access to the Drupal host and monitor the web server process for unexpected behaviour until the update can be applied.

Beyond the patch

Beyond the patch, a public Drupal site deserves a hardening review. Implementation & Assessment Services can test how untrusted input reaches your code and document a reduced attack surface, while Managed Detection & Response can detect the process and account behaviour that follows remote code execution.