Drupal core Field UI remote code execution (CVE-2026-108097, SA-CORE-2026-014)
Drupal core (Field UI module)
A remote code execution vulnerability exists in the Field UI module in Drupal core. It isn't directly exploitable with core alone, but the Drupal Security Team says multiple serious exploit paths exist with contributed modules, at least one without authentication, and custom code may also expose it. Rated Critical (19/25). Update to Drupal 11.4.10, 11.3.19 or 10.6.19; uninstalling the core Field UI module (field_ui) mitigates it until then.
Why this severity: Drupal 'Critical' 19/25; exploit paths via contributed modules, one unauthenticated; exploitation marked theoretical
- Started
- Oct 14, 2026
Affected
- Drupal >= 8.9.0, < 10.6.19
- Drupal >= 11.0.0, < 11.3.19
- Drupal >= 11.4.0, < 11.4.10
- Drupal >= 12.0.0-alpha1, < 12.0.0-beta2
Fixed in
- Drupal 10.6.19
- Drupal 11.3.19
- Drupal 11.4.10
- Drupal 12.0.0-beta2
Timeline1
Advisories2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
