CVE-2026-55803

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

Published Jun 17, 2026 · Drupal Drupal

Research mention from Google Threat Intelligence. This is not vendor confirmation or proof of exploitation. Written by: Alex Tselevich, Michael Maturi Introduction <span s

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Jun 17, 2026 · Drupal Security
Detected
Project: Drupal core Project machine name: drupal <div cl

Sources

Drupal SecurityVendor advisoryCVE-2026-55803
Project: Drupal core Project machine name: drupal <div cl
drupal.org
Google Threat IntelligenceThreat researchCVE-2026-55803
Research mention from Google Threat Intelligence. Not confirmation of exploitation.
cloud.google.com