# Drupal core Field UI remote code execution (CVE-2026-108097, SA-CORE-2026-014) · pwn.watch

> A remote code execution vulnerability exists in the Field UI module in Drupal core. It isn't directly exploitable with core alone, but the Drupal Security Team says multiple serious exploit paths exist with contributed modules, at least one without authentication, and custom code may also expose it. Rated Critical (19/25). Update to Drupal 11.4.10, 11.3.19 or 10.6.19; uninstalling the core Field UI module (field_ui) mitigates it until then.

Page: https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097 · generated 2026-10-30T05:37:51.190Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Drupal core (Field UI module)
- Started: 2026-10-14
- CVEs: CVE-2026-108097
- Affected: Drupal >= 8.9.0, < 10.6.19; Drupal >= 11.0.0, < 11.3.19; Drupal >= 11.4.0, < 11.4.10; Drupal >= 12.0.0-alpha1, < 12.0.0-beta2
- Fixed in: Drupal 10.6.19; Drupal 11.3.19; Drupal 11.4.10; Drupal 12.0.0-beta2

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097/feed.xml
- JSON Feed: https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097.json
- This file: https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097/llms.txt

## Updates (newest first)
- 2026-10-14: Drupal Security Team publishes SA-CORE-2026-014: Critical RCE in the core Field UI module, fixed in 10.6.19, 11.3.19 and 11.4.10; uninstalling field_ui mitigates. (https://www.drupal.org/sa-core-2026-014)

## Fix brief
# Security brief: Drupal core Field UI remote code execution (CVE-2026-108097, SA-CORE-2026-014)

Source: https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097 · status: live · severity: critical · updated Oct 30, 2026, 03:36 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A remote code execution vulnerability exists in the Field UI module in Drupal core. It isn't directly exploitable with core alone, but the Drupal Security Team says multiple serious exploit paths exist with contributed modules, at least one without authentication, and custom code may also expose it. Rated Critical (19/25). Update to Drupal 11.4.10, 11.3.19 or 10.6.19; uninstalling the core Field UI module (field_ui) mitigates it until then.

Severity detail: Drupal 'Critical' 19/25; exploit paths via contributed modules, one unauthenticated; exploitation marked theoretical

- Product: Drupal core (Field UI module)
- CVE / advisory ids: CVE-2026-108097

## Affected versions
- Drupal >= 8.9.0, < 10.6.19
- Drupal >= 11.0.0, < 11.3.19
- Drupal >= 11.4.0, < 11.4.10
- Drupal >= 12.0.0-alpha1, < 12.0.0-beta2

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Drupal 10.6.19
- Drupal 11.3.19
- Drupal 11.4.10
- Drupal 12.0.0-beta2

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
If a project requires drupal/core below 10.6.19, 11.3.19 or 11.4.10 on its branch, update drupal/core (composer update drupal/core-recommended --with-dependencies). Drupal 11.2.x and older, and 10.5.x and older, are end-of-life.

## Latest updates
- Oct 14, 2026: Drupal Security Team publishes SA-CORE-2026-014: Critical RCE in the core Field UI module, fixed in 10.6.19, 11.3.19 and 11.4.10; uninstalling field_ui mitigates.

## Advisories
- [Drupal core - Critical - Remote code execution - SA-CORE-2026-014](https://www.drupal.org/sa-core-2026-014) (Drupal Security Team)
- [CVE-2026-108097](https://nvd.nist.gov/vuln/detail/CVE-2026-108097) (NVD)

---
Machine-readable: https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.