Prepare emergency Drupal patch window for today 17:00–21:00 UTC
Drupal's Security Team has pre-announced a "highly critical" (20/25 on Drupal's own scale, the second-highest tier) core vulnerability with unauthenticated exploitation and zero complexity; the patch window opens today at 17:00 UTC and the Team has explicitly warned that exploits may surface within hours of release (Drupal PSA-2026-05-18 · NCSC.ch Security Hub 12584, 2026-05-19). All current branches (10.5.x, 10.6.x, 11.2.x, 11.3.x) plus emergency manual patches for EOL 8.9 / 9.5 / 10.4 / 11.1 are in scope. Public-sector Drupal-based portals (Swiss federal, cantonal, municipal; EU agency; university) — schedule an emergency change record now, freeze unrelated changes during the window, monitor Drupal SA feed immediately at 17:00 UTC for the CVE and patch links, and apply within hours rather than within your normal SLA. No technical mitigation exists pre-patch.
The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.
Successful exploitation could allow unauthenticated attackers to fully compromise affected Drupal installations.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.