Synced 08 Oct 2026 18:41 UTC Account

Is Drupal 8.9.20 patched?

Drupal · cycle 8.9 · end of life · Official site ↗
8.9.2020/100Critical · exploited

Current stable (11.4.8): 100/100

Minimum safe version10.4.10

8.9.20 has 1 open critical-or-high vulnerability. Run 10.4.10 or later to clear it. See what 10.4.10 fixes →

Health score20/100
Open issues8
Exploited now1
Cycle 8.9 EOL2021-11-02
Latest release11.4.8

Summary iPlain-English security status for Drupal 8.9.20, built from its CVEs, active-exploitation data, end-of-life date and latest release.

Drupal 8.9.20 is part of the 8.9 release line. 1 actively-exploited vulnerability affects it (CISA KEV). The minimum safe version is 10.4.10 — upgrade to it or later to clear the open critical/high issues. The 8.9 line reached end-of-life on 2021-11-02, so it no longer receives security patches. The latest supported Drupal release is 11.4.8.

Known issues affecting 8.9.20

Exploited first, then by exploitation probability.

CVE-2026-9082 CRITICAL exploited EPSS 16% → fixed in 11.3.10 CVE-2026-6366 MEDIUM EPSS 0% → fixed in 11.3.7 CVE-2026-6365 MEDIUM EPSS 0% → fixed in 11.3.7 CVE-2026-55803 MEDIUM EPSS 0% → fixed in 11.3.12 CVE-2026-55804 MEDIUM EPSS 0% → fixed in 11.3.12 CVE-2026-55806 MEDIUM EPSS 0% → fixed in 11.3.12 CVE-2026-55807 LOW EPSS 0% → fixed in 11.3.12 CVE-2026-55808 MEDIUM EPSS 0% → fixed in 11.3.12

Other Drupal versions

Check another release line of Drupal.

Drupal 11.4.8Drupal 11.3.18Drupal 11.2.14Drupal 11.1.10Drupal 11.0.13Drupal 10.6.18Drupal 10.5.12Drupal 10.4.10Drupal 10.3.14Drupal 10.2.12Drupal 10.1.8Drupal 10.0.11Drupal 9.5.11Drupal 9.4.15Drupal 9.3.22Drupal 9.2.21Drupal 9.1.15Drupal 9.0.14Drupal 8.8.12Drupal 7.103

Frequently asked

Is Drupal 8.9.20 patched?

No — 1 actively-exploited vulnerability affects Drupal 8.9.20. Upgrade to at least 10.4.10.

What version should I upgrade Drupal 8.9.20 to?

Upgrade Drupal 8.9.20 to at least 10.4.10 to clear its 1 open critical-or-high vulnerability.

When does Drupal 8.9 reach end-of-life?

Drupal 8.9 reached end-of-life on 2021-11-02 and no longer receives security patches.

What is the latest version of Drupal?

The latest supported Drupal release is 11.4.8.

Is Drupal 8.9.20 still receiving security updates?

No — Drupal 8.9.20 is on the 8.9 line, which reached end-of-life on 2021-11-02 and no longer receives security updates. Upgrade to 11.4.8 or later to stay supported.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Drupal's official advisory before you patch or upgrade — Drupal official site ↗