The flaws affect supported Drupal releases, meaning site owners on current branches are in scope — not just those running outdated installs. Because the issue enables remote code execution, a successful attack could give an adversary direct control over the affected site.

Recommended actions:

• Update Drupal core to the latest patched release for your version branch as soon as possible.
• Review your site logs for unusual activity if you cannot patch immediately.
• Apply the update during a maintenance window if change control requires it, but do not delay beyond your normal emergency patching threshold.

No specific CVE identifiers were included in the source report, so none are listed here.

Source: BleepingComputer

Has your organization already applied the Drupal core update, or are you waiting on a maintenance window?