CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Drupal Core

product · product:drupal-core

Coverage
1
first 2026-10-16 → last 2026-10-16
Latest activity
2026-10-16
Drupal patches a critical Field UI RCE reachable through contributed modules; uninstall field_ui if you…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, technology
Sources cited
3
2 hosts

Action items (1)

Do-now tasks recorded on the entries about Drupal Core, newest first. Check the date before acting on an older one.

  • Update every Drupal core site to 11.4.10, 11.3.19 or 10.6.19 now, internet-facing sites first, and until a site is updated uninstall its Field UI module (field_ui); update the Entity List module to 3.0.10 wherever it is installed, because updating core does not update it, and plan the migration of any site still on 11.2.x or below, 10.5.x or below, Drupal 8 or Drupal 9, which receive no fix.
    2026-10-16CVE-2026-108097 +1

Defender insights

What each entry about Drupal Core tells a defender to do, newest first.

2026-10-16HIGHDrupal patches a critical Field UI RCE reachable through contributed modules; uninstall field_ui if you cannot update

Exposure · detection

Story timeline

  1. 2026-10-16CVE-2026-108097, Drupal core (SA-CORE-2026-014): a critical Field UI code-execution flaw reachable through contributed modules, at least one without login; fixed in 11.4.10, 11.3.19 and 10.6.19, with no fix for end-of-life branches (Drupal risk 19/25)
    trending-vulnerabilitiesDrupal patches a critical Field UI RCE reachable through contributed modules; uninstall field_ui if you cannot update

Hunting pivots

CVEs
CVE-2026-108097CVE-2026-108099
Releases covered
Drupal Core
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-16/drupal-sa-core-2026-014-cve-2026-108097-field-ui-rce · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-10-16/drupal-sa-core-2026-014-cve-2026-108097-field-ui-rce · ATT&CK page ↗

Entries about Drupal Core (1)

2026-10-16 · view entry permalink →

HIGHCVE-2026-108097 +1NATOA2

CVE-2026-108097, Drupal core (SA-CORE-2026-014): a critical Field UI code-execution flaw reachable through contributed modules, at least one without login; fixed in 11.4.10, 11.3.19 and 10.6.19, with no fix for end-of-life branches (Drupal risk 19/25)

The Drupal Security Team's advisory SA-CORE-2026-014 of 2026-10-14 rates CVE-2026-108097 Critical, 19 out of 25 on Drupal's own scale, a remote code execution flaw in the core Field UI module: the vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules and at least one known path needs no authentication (Drupal Security Team, 2026-10-14). The advisory names no module that opens a path; The Hacker News reads the mechanism from the fix, where Field UI's table element ran whatever PHP callable each row carried in its #region_callback property through call_user_func_array with no check, bypassing the renderer's rule against untrusted callbacks, and 11.4.10 no longer calls it (The Hacker News, 2026-10-15).

Fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19; 11.2.x and below, 10.5.x and below, and Drupal 8 and 9 are end of life and get no fix, which The Hacker News counts at 28.5 percent of the sites reporting a core version in the week of 2026-10-04 (The Hacker News, 2026-10-15). The advisory records no public exploit at publication, but the Security Team's pre-announcement of 2026-10-12 told sites to reserve time "because exploits might be developed within hours or days", and in May Drupal reported exploit attempts within two days of a core SQL injection advisory that CISA then added to its Known Exploited Vulnerabilities catalog (The Hacker News, 2026-10-15). The contributed Entity List module has its own critical code-execution advisory, SA-CONTRIB-2026-218, under the same conditions, at least one known path needing no authentication, and 3.0.10 fixes it (Drupal Security Team, 2026-10-14); the flaw is CVE-2026-108099, and updating core does not update the module (The Hacker News, 2026-10-15).

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication.

which will provide protection while sites are updated

Drupal Security Team 2026-10-14

because exploits might be developed within hours or days.

The Hacker News 2026-10-15
vulnerability16 Oct 04:17Zmulti-sourceOpen finding →
Sources: Drupal Security Team · The Hacker News · Drupal Security Team (SA-CONTRIB-2026-218)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • drupal.org2 (67%)
  • thehackernews.com1 (33%)
All cited sources (3)