Highly Critical Drupal Core Vulnerability Set for May 20, 2026 Disclosure A severe security flaw in Drupal core, rated "Highly Critical" (20/25), is poised to affect websites globally, with an official patch scheduled for release on May 20, 2026. The vulnerability impacts multiple supported versions, including Drupal 11.3.x, 11.2.x, 10.6.x, and 10.5.x, as well as older, unsupported branches like 11.1.x, 10.4.x, 9.5.x, and 8.9.x. Drupal 7 remains unaffected. Due to the flaw’s severity, Drupal will provide limited security updates for unsupported versions, including manual patch files for Drupal 8 and 9 though these may introduce instability. The Drupal Security Team warns that exploits could emerge within hours of disclosure, as attackers often reverse-engineer patches to identify vulnerabilities. Potential attack scenarios include unauthenticated access, data manipulation, or privilege escalation, depending on the flaw’s specifics. Administrators are urged to prepare for the patch release window (17:00–21:00 UTC) by reserving maintenance time and updating to the latest versions (11.3 or 10.6) before May 20. Legacy systems require upgrades to 11.1.9, 10.4.9, 9.5.11, or 8.9.20 before applying patches. Sites using Drupal Steward are already protected against known attack vectors. The Drupal Security Team issued PSA-2026-05-18, emphasizing the need for immediate patching to mitigate risks. Full technical details will be disclosed on May 20 via Drupal’s official channels. The advisory underscores the urgency of proactive patch management to prevent potential compromises.