Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules

Drupal has disclosed a critical remote code execution vulnerability in its Field UI module affecting Drupal core. The flaw was patched on October 14 in versions Drupal 11.4.10, 11.3.19, and 10.6.19. While the vulnerability cannot be exploited through core alone, multiple exploit paths exist via contributed modules. At least one known exploit path requires no authentication, making it especially dangerous. The Drupal Security Team issued an advisory urging users to update immediately. Sites running contributed modules that interact with Field UI are at highest risk. The unauthenticated path significantly raises the severity of this vulnerability.