This vulnerability allows an attacker to trigger PHP's reflection mechanism using externally supplied input that is not properly validated. By controlling the target class name, an attacker can cause arbitrary code execution from within the Drupal core, potentially giving full control over the compromised system. The weakness is a classic unsafe reflection flaw, matching CWE‑470, and it can be abused to execute malicious code without authentication if the attacker can reach a vulnerable input point.

Drupal core is affected across a range of major releases. The vulnerable range includes all Drupal 8.9.x to 10.6.19, Drupal 11.0.0 through 11.3.19, Drupal 11.4.0 to 11.4.10, and the early releases of Drupal 12 from 12.0.0‑alpha1 up to 12.0.0‑beta2. Any site running one of these versions without the patch is at risk.

The alert is classified as a critical Remote Code Execution, but the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, which makes precise exploitation probability difficult to gauge. However, due to the nature of the flaw—an unfiltered reflection call—any remote user who can invoke the vulnerable endpoint may trigger the attack. The advisory’s description underscores that the vulnerability is inherently high‑risk, and it is inferred that the attack vector is remote, likely via a crafted HTTP request to a Drupal endpoint that accepts class names from user input.