Patch Forecast
Clear
Monitor.

CVE-2026-108097

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in…

Risk score
29/100
CVSS
Not Scored
Exploit chance (30 days)
0.3%
Published
30 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Affected
See advisory
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Exploitation reported in the press

Story map

Story map: CVE-2026-108097THE FLAWSTHE FIXCVE-2026-108097Use of Externally-ControlledInput to Select Classes orCode ('Unsafe Reflection')…EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedSee advisoryCLEAR · MONITORCVE-2026-108097Use of Externally-ControlledInput to Select Classes or Code('Unsafe Reflection')vulnerability in Drupal Drupalcore allows ReflectionInjection. This issue affectsDrupal core versions: from…Where it standsExploitation reported in the press2 outlets covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.30 Oct · BleepingComputerDrupal warns of critical Commerce Core flawexploited in attacks30 Oct · SecurityWeekDrupal Commerce Core Vulnerability ExploitedAgainst Online StoresCONNECTS TOSame weaknessCWE-470 (CWE-470)31 other warnings in 30 days →Reported alongsideMissing Authorizationvulnerability in Drupal…CVE-2026-118539 · in 2 of the samearticles →Reported alongsideUse of Externally-ControlledInput to Select Classes or Code…CVE-2026-108099 · in 2 of the samearticles →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

CVE-2026-108097: Clear, monitor. Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

The flaws

  • CVE-2026-108097: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in… (EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: See advisory

Where it stands

  • Exploitation reported in the press
  • 2 outlets covering it

How it unfolded

  1. 30 Oct, BleepingComputer (press): Drupal warns of critical Commerce Core flaw exploited in attacks
  2. 30 Oct, SecurityWeek (press): Drupal Commerce Core Vulnerability Exploited Against Online Stores

Connects to

In the news

TL;DR

Drupal Commerce Core vulnerability exploited in the wild, affecting over 42,000 sites, with attackers targeting online stores.

  • Drupal warns of critical Commerce Core flaw exploited in attacks
  • Attackers can exploit the flaw no matter how the module is set up, with a risk score of 21 out of 25.
  • Administrators should update to one of the two fixed versions and review their store orders for inconsistencies.

AI summary of 2 articles.

Why it is Clear

  • Not yet scored by NVD

References

Original description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

Last activity 30 Oct 2026. Patch Forecast updates every hour.