Drupal Core Patch Drops Today: No-Login Flaw Puts Government and University Sites at Immediate Risk

The Drupal Security Team is releasing patches for all supported core branches today, May 20, 2026, between 17:00 and 21:00 UTC — and every administrator of a Drupal-powered website should be at their terminal when it lands. The vulnerability, catalogued as PSA-2026-05-18, carries a severity score of 20 out of 25 on Drupal's published security scoring model and requires no authentication and no special access conditions to exploit. The team's own advisory warns that working exploits could emerge within hours of the patch being made public — a timeline that erases the usual days-long buffer administrators rely on to schedule maintenance.

The urgency extends to some of the highest-stakes web infrastructure on the internet. Drupal is the content management system of choice for government ministries, federal agencies, public universities, and national research institutions — the kind of sites where a successful intrusion could expose sensitive constituent data or compromise digital services used by millions. The University of California, Berkeley's Information Security Office specifically warned that an attacker could reverse-engineer the patch to build working exploit code almost immediately after publication, collapsing the effective response window from days to hours.

Scoring Profile Mirrors Drupalgeddon

Drupal scores its security advisories across six dimensions: access complexity, authentication requirements, confidentiality impact, integrity impact, exploit availability, and target distribution. PSA-2026-05-18 receives the worst possible rating on two of the most consequential dimensions: Access Complexity is "None" and Authentication is "None." In operational terms, any attacker with network access to a vulnerable Drupal installation needs nothing else — no stolen credentials, no elevated privileges, no special configuration knowledge.

The potential impact is rated at maximum severity for both confidentiality and integrity, per the advisory's published scoring matrix. That means non-public data could be read and site data could be modified or deleted. The score stops at 20 rather than the maximum 25 only because the Exploit Vector is currently classified as "Theoretical" — no public proof-of-concept code exists yet — and the Target Distribution is rated "Uncommon," indicating the flaw is exploitable only under specific configuration conditions. Those classifications are expected to change rapidly once the patch ships.

Security analysts note the scoring profile closely parallels the 2018 Drupalgeddon2 flaw (CVE-2018-7600), which triggered one of the fastest and most widespread mass-exploitation campaigns ever directed at a content management system, as documented by Palo Alto Networks' Unit 42 threat research team. Within weeks of that advisory, automated scanning tools were probing every reachable Drupal installation on the internet, and over 100,000 sites were confirmed vulnerable before patching was widespread. Cryptocurrency miners, backdoors, and other malicious payloads were installed silently on unpatched servers — a criminal campaign documented in detail by security firm Volexity that proved highly profitable for its operators. The Register confirmed this week that no Drupal vulnerability has been exploited in the wild since 2019, making PSA-2026-05-18 the first highly critical flaw to emerge in years.

Affected Branches and EOL Extensions

All currently supported Drupal core branches require patching: Drupal 11.3.x, 11.2.x, 10.6.x, and 10.5.x. In an unusual step that signals how seriously the Security Team is treating the potential blast radius, manual patch files are also being made available for the fully end-of-life Drupal 8.9 and 9.5 branches — platforms the project no longer officially supports. The team's advisory includes a direct caution: these patches are not guaranteed to work correctly, may introduce regressions, and are explicitly a temporary measure until affected sites can migrate to a supported release.

Drupal 7 has been confirmed unaffected. Critically, the flaw is in Drupal core — the developer-facing platform — and not in Drupal CMS, the preconfigured, non-developer product, as The Register clarified.

Sites running Drupal Steward, Drupal's paid web application firewall service, have been given advance protection against known attack vectors. The Security Team nonetheless recommends Steward customers still apply the upstream patch in case additional exploit methods are identified after the advisory goes public. Hosting provider amazee.io announced it is staging WAF and content delivery network "virtual patches" ahead of the advisory release, describing them explicitly as partial and temporary mitigation while identifying the upstream patch as the only reliable fix.

Universities and Government Agencies Already on Alert

The elevated institutional exposure here is not incidental. Among Drupal's heaviest users are the sites that handle the most sensitive data and face the most constrained IT staffing windows: government portals, university platforms, federal agencies, and public health systems.

The University of Michigan's Safe Computing office issued an alert urging staff to reserve personnel time before today's patching window. Berkeley's warning goes further, noting that the combination of no-authentication exploitation and the likelihood of rapid patch reverse-engineering means an institution still unpatched 24 hours after the advisory is published should assume it has been targeted. Government users of Drupal include NASA, the U.S. Internal Revenue Service, the European Commission, and national government portals across multiple countries, making the potential scope of unpatched exposure particularly serious.

What Administrators Should Do Now

Every administrator running a Drupal installation should treat the hours between now and tonight as an emergency maintenance window. The Drupal Security Team's recommended sequence, drawn from the PSA and confirmed by institutional advisories:

Verify the current branch in use — Drupal 11.3.x, 11.2.x, 10.6.x, or 10.5.x are all affected. If running an unsupported minor version such as 11.1, 11.0, 10.4, 10.3, 10.2, 10.1, or 10.0, update to at least Drupal 11.1.9 or 10.4.9 now so the security patch can be applied cleanly. Have staff available during the full 17:00–21:00 UTC window. Apply the security update immediately upon release, then read the mitigation guidance in the advisory — not all configurations are affected, and the advisory will clarify scope. For sites on Drupal 8.9 or 9.5, manually apply the EOL patch file as soon as it becomes available, then prioritize migration to Drupal 10.6 or 11.3. Do not wait: the 2018 precedent and the flaw's zero-authentication, zero-complexity profile mean any unpatched Drupal installation is a target, and that window is measured in hours, not days.

The full advisory, mitigation guidance, and patch files will be published at drupal.org/security the moment they are released.