As cited
Copy frozen at (site build).
vulnerabilities
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal released patches for a critical remote code execution (RCE) vulnerability in its Field UI module on October 14. The flaw requires a contributed module to be exploited, with at least one attack path requiring no authentication, affecting versions 10, 11.3, and 11.4.
Why it matters: Drupal site administrators must immediately update to versions 10.6.19, 11.3.19, or 11.4.10 to close an unauthenticated RCE path; attackers actively weaponize critical Drupal flaws within hours of disclosure.
- Source published
- First seen by Cybersecurity Tracker