CVE-2026-11915 is a vulnerability in the Drupal Brute force attack protection mechanism. This vulnerability potentially allows an attacker to circumvent brute force protections, impacting the confidentiality and integrity of the system. The vulnerability affects all versions of the Brute force attack protection component. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact. No vendor advisory or patch information is currently available.

The vulnerability could allow attackers with high privileges to bypass brute force attack protections, potentially leading to unauthorized access or data compromise. Confidentiality and integrity impacts are rated high, meaning sensitive information could be exposed or altered. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published. Organizations should monitor Drupal security advisories for updates and apply patches promptly once available.