CVE-2026-108097, Drupal core (SA-CORE-2026-014): a critical Field UI code-execution flaw reachable through contributed modules, at least one without login; fixed in 11.4.10, 11.3.19 and 10.6.19, with no fix for end-of-life branches (Drupal risk 19/25)
Drupal patches a critical Field UI RCE reachable through contributed modules; uninstall field_ui if you cannot update
Defender actions
- Update every Drupal core site to 11.4.10, 11.3.19 or 10.6.19 now, internet-facing sites first, and until a site is updated uninstall its Field UI module (field_ui); update the Entity List module to 3.0.10 wherever it is installed, because updating core does not update it, and plan the migration of any site still on 11.2.x or below, 10.5.x or below, Drupal 8 or Drupal 9, which receive no fix.
Analysis
The Drupal Security Team's advisory SA-CORE-2026-014 of 2026-10-14 rates CVE-2026-108097 Critical, 19 out of 25 on Drupal's own scale, a remote code execution flaw in the core Field UI module: the vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules and at least one known path needs no authentication (Drupal Security Team, 2026-10-14). The advisory names no module that opens a path; The Hacker News reads the mechanism from the fix, where Field UI's table element ran whatever PHP callable each row carried in its #region_callback property through call_user_func_array with no check, bypassing the renderer's rule against untrusted callbacks, and 11.4.10 no longer calls it (The Hacker News, 2026-10-15).
Fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19; 11.2.x and below, 10.5.x and below, and Drupal 8 and 9 are end of life and get no fix, which The Hacker News counts at 28.5 percent of the sites reporting a core version in the week of 2026-10-04 (The Hacker News, 2026-10-15). The advisory records no public exploit at publication, but the Security Team's pre-announcement of 2026-10-12 told sites to reserve time "because exploits might be developed within hours or days", and in May Drupal reported exploit attempts within two days of a core SQL injection advisory that CISA then added to its Known Exploited Vulnerabilities catalog (The Hacker News, 2026-10-15). The contributed Entity List module has its own critical code-execution advisory, SA-CONTRIB-2026-218, under the same conditions, at least one known path needing no authentication, and 3.0.10 fixes it (Drupal Security Team, 2026-10-14); the flaw is CVE-2026-108099, and updating core does not update the module (The Hacker News, 2026-10-15).
Cited evidence
The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication.
which will provide protection while sites are updated
because exploits might be developed within hours or days.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.