Is CVE-2026-114573 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114573 being exploited in the wild.

How severe is CVE-2026-114573?

Informational severity, published 30 October 2026.

How is CVE-2026-114573 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114573?

Check whether you run Drupal Monster Menus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114573: Drupal Monster Menus PHP object injection in RSS Page

CVE-2026-114573 · Severity: info · Published 2026-10-30

Monster Menus is a Drupal module that creates multisite content with granular page permissions and an RSS aggregation submodule. A PHP object injection vulnerability in the RSS Page submodule allows authenticated users with the "RSS Feed: Create new content" permission to execute arbitrary code when creating nodes with malicious RSS feed input.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-114573 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114573 being exploited in the wild.
How severe is CVE-2026-114573?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Drupal Monster Menus all versions before 9.5.6; Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus ECOSYSTEM:introduced=0,fixed=9.5.6.
Is there a fix for CVE-2026-114573?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus: upgrade to 9.5.6 or later. Until then: Disable the RSS Page submodule if not in use. Restrict the "RSS Feed: Create new content" permission to trusted users until the module is upgraded to version 9.5.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114573 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114573?: Check whether you run Drupal Monster Menus or Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus: upgrade to 9.5.6 or later

Disable the RSS Page submodule if not in use. Restrict the "RSS Feed: Create new content" permission to trusted users until the module is upgraded to version 9.5.6.

Technical details

The vulnerability exists in the RSS Page submodule's node creation form processing, which uses PHP's unserialize() function on untrusted input, enabling PHP object injection attacks. An attacker requires authentication with the specific "RSS Feed: Create new content" role permission and must have the RSS Page submodule enabled. Successful exploitation grants remote code execution.

Affected products

Drupal Monster Menus all versions before 9.5.6

Identifiers

CVE-2026-114573
DRUPAL-CONTRIB-2026-253

Timeline

2026-10-21: disclosed
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.