# Drupal 11.2.14: end of life

This release line no longer gets security fixes.

- Recommended: 11.3.20 (lowest fixed release that is still supported)
- Known vulnerabilities: 7 (0 critical, 0 high, 3 medium, 0 low)
- End of life: yes, since 2026-07-01 (release line 11.2)
- Data as of: 2026-10-24 19:22 UTC

## Vulnerabilities

| ID | Severity | Actively exploited | Fixed in |
|---|---|---|---|
| [CVE-2026-55805](https://www.drupal.org/sa-core-2026-012) | medium | no | 11.3.14 |
| [CVE-2026-15917](https://www.drupal.org/sa-core-2026-011) | medium | no | 11.3.14 |
| [CVE-2026-15916](https://www.drupal.org/sa-core-2026-010) | medium | no | 11.3.14 |
| [DRUPAL-CORE-2026-013](https://osv.dev/vulnerability/DRUPAL-CORE-2026-013) | unknown | no | 11.3.17 |
| [CVE-2026-108515](https://osv.dev/vulnerability/DRUPAL-CORE-2026-015) | unknown | no | 11.3.19 |
| [CVE-2026-108514](https://osv.dev/vulnerability/DRUPAL-CORE-2026-016) | unknown | no | 11.3.19 |
| [CVE-2026-108097](https://osv.dev/vulnerability/DRUPAL-CORE-2026-014) | unknown | no | 11.3.19 |

Installed with apt, yum or another package manager? Your distribution may already have patched this without changing the version, so check its security tracker too.

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/drupal/11.2.14 · JSON: https://fixedin.dev/drupal/11.2.14.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt