CVE-2026-11915 Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047
The Drupal Brute Force Attack Protection module is unsupported, leaving sites vulnerable to brute force attacks due to lack of maintenance.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11915?
CVE-2026-11915 is a medium-severity vulnerability in Drupal Brute force attack protection, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
Weakness: CWE-307
Which versions are affected by CVE-2026-11915?
Linux distribution packages (1)
drupal/bfap_sb Packagist:https://packages.drupal.org/8 | All versions | None |
How do I fix CVE-2026-11915?
No fix has been published for CVE-2026-11915 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11915 being exploited?
There is no known exploitation of CVE-2026-11915 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-047, GHSA-q4vw-q8jq-2jg7.