CriticalCVE
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
The Hacker News·Source published ·1 min read
What happened?
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
Key details
- Fixed versions released: Drupal 11.4.10, 11.3.19, and 10.6.19 on October 14, 2026
- Uninstalling Field UI module provides temporary protection until update
- Drupal Steward WAF blocks some known attack vectors for this flaw
Affected
- Drupal 11.2.x and below, 10.5.x and below, Drupal 8 and 9 are end-of-life with no fix
- Sites on branches losing security coverage in December 2026: 11.3.x and 10.6.x
Fixes and mitigations
- Uninstall Field UI module for temporary protection
- Drupal Steward WAF blocks some known attack vectors
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.