The Bottom Line: Drupal releases an urgent security update on May 20, 2026 for critical vulnerabilities. Website operators should prepare and update their systems to the latest patch versions beforehand. Drupal strongly recommends avoiding outdated versions and upgrading to newer releases.
The open-source content management system Drupal is warning of a critical security vulnerability and plans to release an urgent security update for all supported versions on May 20, 2026 between 17 and 21 hours UTC. Website operators are asked to prepare accordingly and update their systems.
The Drupal Security Team is announcing a “Core Security Release” for all supported versions and warns that exploits could potentially be developed within hours or days. The team strongly recommends site administrators to schedule time for core updates during the release window.
Not all configurations are affected by the security vulnerability. Drupal will provide information on mitigating the vulnerability in the corresponding security advisory.
Security patches will be available for the following supported versions: 11.3.x, 11.2.x, 10.6.x, and 10.5.x. Website operators should update their systems to the latest patch versions of their respective branch before May 20 to resolve any pending upgrade issues.
For sites running older, no longer supported versions such as Drupal 8 and 9, manual patch files will be provided, but without guarantee of error-free operation. Drupal strongly recommends upgrading to Drupal 10.6 or newer, as older versions contain numerous additional already-disclosed security vulnerabilities.
For preparation, the following guidelines apply: sites on Drupal 11.1 or 11.0 should update to at least version 11.1.9; sites on Drupal 10.x to at least 10.4.9. Drupal 7 is not affected by this security vulnerability.