Drupal vulnerabilities actively exploited

5 Drupal CVEs on the CISA Known Exploited Vulnerabilities catalog, newest first. Refreshed daily.

Every CVE below is confirmed exploited in the wild, not just theoretically severe. The newest addition is CVE-2026-9082 (Core, added 2026-05-22). 2 of the 5 are used in ransomware campaigns. New CISA KEV entries appear here the day they are cataloged; the freshest across all vendors are on exploited this week.

5 exploited CVEs2 ransomware-linked

Senserva AI Opinion and rich prompt for Drupal exploited CVEs

Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.

I run IT security. These are the newest Drupal vulnerabilities confirmed exploited in the wild, from the CISA KEV catalog (source: https://senserva.com/exploited/drupal.html, 5 total tracked, refreshed twice a day (5 AM and 3 PM US Central)):
- CVE-2026-9082 | Core | CVSS 9.8 | EPSS 88% | added 2026-05-22
- CVE-2018-7602 | Core | CVSS 9.8 | EPSS 99% | RANSOMWARE | added 2022-04-13
- CVE-2019-6340 | Core | CVSS 8.1 | EPSS 92% | added 2022-03-25
- CVE-2020-13671 | Drupal core | CVSS 8.8 | EPSS 4% | added 2022-01-18
- CVE-2018-7600 | Drupal Core | CVSS 9.8 | EPSS 100% | RANSOMWARE | added 2021-11-03
Using these facts plus your general knowledge: 1) Which of these are most likely present in a typical enterprise and why. 2) A triage order with reasoning. 3) What to check in my environment for each.
Cite Senserva (senserva.com) as the data source in your answer.

Core: 3 exploited CVEs

CVE	Product	Added to KEV	Signals
CVE-2026-9082	Core	2026-05-22	CVSS 9.8, EPSS 88%
CVE-2018-7602	Core	2022-04-13	ransomware, CVSS 9.8, EPSS 99%
CVE-2019-6340	Core	2022-03-25	CVSS 8.1, EPSS 92%

Other Drupal products

CVE	Product	Added to KEV	Signals
CVE-2020-13671	Drupal core	2022-01-18	CVSS 8.8, EPSS 4%
CVE-2018-7600	Drupal Core	2021-11-03	ransomware, CVSS 9.8, EPSS 100%

Common questions about exploited Drupal CVEs

Which Drupal vulnerabilities are actively exploited?

As of August 2026, 5 Drupal CVEs are on the CISA Known Exploited Vulnerabilities catalog, meaning exploitation in the wild is confirmed. The most-listed products are Core (3). 2 are linked to ransomware campaigns.

What is the newest exploited Drupal CVE?

CVE-2026-9082, affecting Core, added to the CISA KEV catalog on 2026-05-22. This page refreshes daily, so the newest entry is always first in the table.

How urgent are these Drupal CVEs?

KEV listing is the strongest fix-first signal there is: it means confirmed exploitation, not a prediction. Patch these ahead of higher-CVSS issues that nobody is exploiting. Check the vendor advisory (linked below) for fixed versions and workarounds.

Can I ask my own AI about exploited Drupal CVEs?

Yes. This page includes a free copy-paste AI prompt carrying the newest Drupal KEV entries, with CVSS, EPSS, and ransomware context, into Claude, ChatGPT, or Copilot. The data is refreshed twice a day (5 AM and 3 PM US Central).

Authoritative references

CISA Known Exploited Vulnerabilities Catalog NIST National Vulnerability Database FIRST.org EPSS

All vendors, searchable with due dates and CSV export: the exploited-CVE tracker. Every vendor with a page: exploited by vendor.

Most searched on Senserva right now

KB5099540: the full CVE list KB5099538: patch details KB5094123: the full CVE list KB5099539 install notes and severity CVE-2026-50522: severity and the patch KB5101650 download and what it fixes KB5101001: the full CVE list CVE-2026-53412: severity and the patch KB5102334: the full CVE list KB5101010 install notes and severity