Drupal Warns of Highly Critical Core Flaw Requiring Immediate Emergency Patching

Drupal has warned administrators to prepare for an emergency core security release affecting all supported branches, saying the undisclosed flaw is highly critical, easy to exploit, and could be weaponized within hours or days of disclosure. According to Drupal and follow-on reporting, the vulnerability requires no privileges and may let attackers expose non-public data or modify or delete site content, although it appears limited to certain uncommon configurations rather than every deployment. A related advisory from dCERT also flagged a Drupal Core vulnerability enabling an unspecified attack.

Security updates are scheduled for supported branches 11.3.x, 11.2.x, 10.6.x, and 10.5.x, with best-effort fixes also planned for older 11.1.x and 10.4.x releases. Sites running 8.9 and 9.5 are expected to receive manual patch files only, with warnings about possible regressions and renewed pressure to upgrade to supported versions such as Drupal 10.6 or later; Drupal 7 is not affected. Drupal Steward customers were said to be protected against known attack vectors, but Drupal still urged all organizations to reserve maintenance time and apply the patch immediately once released.