Drupal Updates Address Critical RCE and Information Disclosure Vulnerabilities
Vulnerability Disclosure · 2 sources · Updated 1mo ago · First seen Jul 15, 2026
Drupal released security updates addressing multiple vulnerabilities that could potentially lead to full system compromise, according to a July 15 EG-FinCIRT advisory. The advisory highlights CVE-2026-9726, a remote code execution vulnerability in Drupal AlternativeCommerce, and CVE-2026-10768, an information disclosure vulnerability in Drupal LocalGov Workflows. EG-FinCIRT reports a CVSS score of 9.8 for each and describes both as remotely exploitable with low attack complexity, no required privileges, and no user interaction.
The advisory lists Drupal Commerce, Clean RESTful, Drupal Canvas, AlternativeCommerce Basket, and Siteimprove Analytics among affected products and recommends deploying patches as soon as testing is complete. Organizations running these components should prioritize identifying exposed installations and validating and applying the relevant updates. The supplied references do not establish whether either vulnerability has been exploited in the wild.
