Is CVE-2026-126739 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126739 being exploited in the wild.

How severe is CVE-2026-126739?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal Page Manager before 4.1.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Page Manager ECOSYSTEM:introduced=0,fixed=4.1.0.

How is CVE-2026-126739 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126739?

Check whether you run Drupal Page Manager or Packagist:Https://Packages.Drupal.Org/8 Drupal/Page Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126739: Drupal Page Manager CSRF in UI submodule

CVE-2026-126739 · Severity: info · Published 2026-11-11

Drupal's Page Manager module, which allows administrators to create custom pages and override existing paths, contains a cross-site request forgery (CSRF) vulnerability in its UI submodule. An attacker could trick an administrator into enabling or disabling pages without their knowledge. The risk is limited because both the UI submodule and the "administer pages" permission must be present.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126739 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126739 being exploited in the wild.
How severe is CVE-2026-126739?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Page Manager before 4.1.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Page Manager ECOSYSTEM:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2026-126739?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Page Manager: upgrade to 4.1.0 or later. Until then: As a workaround, uninstall the Page Manager UI submodule on production sites; existing pages will continue to function without it. After upgrading, run database updates or clear caches to activate the fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126739 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126739?: Check whether you run Drupal Page Manager or Packagist:Https://Packages.Drupal.Org/8 Drupal/Page Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Page Manager: upgrade to 4.1.0 or later

As a workaround, uninstall the Page Manager UI submodule on production sites; existing pages will continue to function without it. After upgrading, run database updates or clear caches to activate the fix.

Technical details

The Page Manager UI submodule fails to implement CSRF protections, allowing unauthenticated attackers to forge requests that modify page settings. The vulnerability requires that the Page Manager UI submodule be enabled and the targeted user must possess the "administer pages" permission. This is a classical CSRF affecting administrative functionality with reduced blast radius due to prerequisites.

Affected products

Drupal Page Manager before 4.1.0

Identifiers

CVE-2026-126739
DRUPAL-CONTRIB-2026-330

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.