CVE-2026-118563: Cacheflush · The Drupal Security Team is marking this project unsupported
Affects drupal/cacheflushSource GCVE Database
Not known to be exploited · end of life, no fix coming : replace or isolate drupal/cacheflush; no fix will be released.
Data as of 28 Oct 2026, 20:42 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Patch
- None coming – the product is end of life
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
No fix will be released: drupal/cacheflush is end of life. Replace it, or isolate it from untrusted networks until you can.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagist https //packages.drupal.org/8drupal/cacheflush | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The Drupal Security Team provides documentation for becoming the primary maintainer of unsupported projects for security reasons.
Description
The Drupal Security Team has marked the Cacheflush project as unsupported due to an unresolved security issue. The maintainer has not fixed the known vulnerability, and the project is no longer maintained by the Drupal Security Team. Users are advised to consider taking over maintenance if they wish to address the security concerns.