Drupal 11.4.4

Drupal 11.4.4 has been released as a security release — the Drupal security team urges all site owners to update immediately. This release patches three moderately critical vulnerabilities affecting Drupal core.

Security Advisories

Drupal 11.4.4 addresses the following security issues:

• SA-CORE-2026-010 — Information disclosure vulnerability. A moderately critical flaw that could allow unauthorized access to sensitive information under certain conditions.
• SA-CORE-2026-011 — Cross-site scripting (XSS) vulnerability. A moderately critical issue that could enable attackers to inject malicious scripts into Drupal pages.
• SA-CORE-2026-012 — Cross-site scripting (XSS) vulnerability. A second moderately critical XSS issue that has been identified and patched.

Who Should Update

All sites running Drupal 11.4.x should update to 11.4.4 immediately. The Drupal security team recommends applying this update as soon as possible given the active nature of the vulnerabilities patched.

No Other Changes

This release is a focused security patch release and contains no other fixes or features beyond the three security advisories listed above. Sites already on Drupal 11.4.3 can upgrade directly to 11.4.4 without any additional migration steps.

How to Update

Update your Drupal core using Composer:

composer update drupal/core --with-all-dependencies

After updating, run update.php and clear the cache via the administration interface or Drush:

drush updatedb
drush cr

Drupal 11.4.4 is available for download from the Drupal project page. Keep your Drupal sites secure by staying on the latest release.