Drupal core - Critical - Remote code execution - SA-CORE-2026

Drupal • October 14, 2026

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module ( field_ui ), which will provide protection while sites are updated.

Drupal Steward protection:

This issue is being protected by Drupal Steward . Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Install the latest version:

If you use Drupal 11.4.x, update to Drupal 11.4.10 .

If you use Drupal 11.3.x, update to Drupal 11.3.19 .

Drupal 11.2.x and below are end-of-life and do not receive security coverage.

If you use Drupal 10.6.x, update to Drupal 10.6.19 .

Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Drew Webber (mcdruid) of the Drupal Security Team

Octavio Galland (ogalland-tob)

catch (catch) of the Drupal Security Team

Lee Rowlands (larowlan) of the Drupal Security Team

Dave Long (longwave) of the Drupal Security Team

Drew Webber (mcdruid) of the Drupal Security Team

Jess (xjm) of the Drupal Security Team

Swan Kalata (akalata) of the Drupal Security Team

Bram Driesen (bramdriesen) of the Drupal Security Team

catch (catch) of the Drupal Security Team

Greg Knaddison (greggles) of the Drupal Security Team

Tim Hestenes Lehnen (hestenet)

Lee Rowlands (larowlan) of the Drupal Security Team

Dave Long (longwave) of the Drupal Security Team

Drew Webber (mcdruid) of the Drupal Security Team

Juraj Nemec (poker10) of the Drupal Security Team

Pierre Rudloff (prudloff) of the Drupal Security Team

Jess (xjm) of the Drupal Security Team

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Drupal Patches Critical RCE Flaw in Field UI Module Drupal has released patches for a critical remote code execution vulnerability in its Field UI module, tracked as CVE-2026-108097. This flaw allows attackers to execute code on the server through contributed modules, with at least one known exploit path that does not require authentication. The vulnerability received a risk rating of 19 out of 25 from Drupal, classifying it as critical. Affected versions include Drupal 11.4.x, 11.3.x, and 10.6.x, with updates released on October 14, 2026. Sites using versions 11.2.x and below, as well as 10.5.x and earlier, are end-of-life and do not receive security coverage. As of October 15, no public exploit code has been reported, but the Drupal Security Team warned that exploits could emerge quickly. Administrators are advised to update their installations or uninstall the Field UI module as a temporary measure. 2 sources 71

Extracted Entities

Drupal core - Critical - Remote code execution - SA-CORE-2026

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)