---
schema: 1
kind: vulnerability
title: "CVE-2026-108097, Drupal core (SA-CORE-2026-014): a critical Field UI code-execution flaw reachable through contributed modules, at least one without login; fixed in 11.4.10, 11.3.19 and 10.6.19, with no fix for end-of-life branches (Drupal risk 19/25)"
headline: "Drupal patches a critical Field UI RCE reachable through contributed modules; uninstall field_ui if you cannot update"
summary: >
  Drupal's advisory SA-CORE-2026-014 of 2026-10-14 fixes CVE-2026-108097, a remote code execution flaw in the core Field UI module rated Critical (19 of 25): core alone is not directly exploitable, but several
  exploit paths exist through contributed modules and at least one known path needs no login. Fixed releases are 11.4.10, 11.3.19 and 10.6.19; 11.2.x and below, 10.5.x and below and Drupal 8 and 9 get no fix, and
  until a site is updated the advisory's mitigation is to uninstall the Field UI module. The advisory records no public exploit at publication, and The Hacker News relays the Security Team's pre-announcement warning that exploits might be developed within hours or days.
discovered_at: "2026-10-16T04:17:00Z"
updated_at: null
event_date: "2026-10-14"
run_id: 2026-10-16T0256Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: [public-sector, technology]
entities: ["product:drupal-core", "product:drupal-entity-list"]
techniques: [T1190, T1059]
affected_products: ["Drupal Core", "Drupal Entity List"]
cves:
  - id: CVE-2026-108097
    cvss: "Critical 19/25 (Drupal risk score)"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Drupal core from 8.9.0 before 10.6.19, from 11.0.0 before 11.3.19 and from 11.4.0 before 11.4.10 and the 12.0 pre-release before 12.0.0-beta2, with the Field UI module installed; core alone is not directly exploitable and the known paths run through contributed modules or custom code"
    fixed: "11.4.10, 11.3.19 and 10.6.19 (12.0.0-beta2 on the pre-release line, not for production); no fix for 11.2.x and below, 10.5.x and below, Drupal 8 and Drupal 9, which are end of life"
  - id: CVE-2026-108099
    cvss: "Critical 19/25 (Drupal risk score)"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Entity List contributed module, all versions before 3.0.10, under the same conditions as the core flaw including a known path that needs no login"
    fixed: "Entity List 3.0.10; updating core does not update the module"
sources:
  - url: "https://www.drupal.org/sa-core-2026-014"
    publisher: "Drupal Security Team"
    date: "2026-10-14"
    role: primary
  - url: "https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html"
    publisher: "The Hacker News"
    date: "2026-10-15"
    role: corroborating
  - url: "https://www.drupal.org/sa-contrib-2026-218"
    publisher: "Drupal Security Team (SA-CONTRIB-2026-218)"
    date: "2026-10-14"
    role: corroborating
closed_sources: []
evidence:
  - quote: "The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication."
    publisher: "Drupal Security Team"
    source_url: "https://www.drupal.org/sa-core-2026-014"
  - quote: "which will provide protection while sites are updated"
    publisher: "Drupal Security Team"
    source_url: "https://www.drupal.org/sa-core-2026-014"
  - quote: "because exploits might be developed within hours or days."
    publisher: "The Hacker News"
    source_url: "https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html"
verification: multi-source
sourcing_note: >
  Drupal's advisory names the CVE and carries the affected and fixed versions, the risk score and the mitigation as the vendor's disclosure for its own product; The Hacker News is the source for the mechanism read from the fix, for the pre-announcement quote and for the note that updating core does not update the Entity List module, whose CVE id, risk score and fixed version come from Drupal's own SA-CONTRIB-2026-218.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Update every Drupal core site to 11.4.10, 11.3.19 or 10.6.19 now, internet-facing sites first, and until a site is updated uninstall its Field UI module (field_ui); update the Entity List module to 3.0.10 wherever it is installed, because updating core does not update it, and plan the migration of any site still on 11.2.x or below, 10.5.x or below, Drupal 8 or Drupal 9, which receive no fix."
updates: []
migrated_from: null
---

The Drupal Security Team's advisory SA-CORE-2026-014 of 2026-10-14 rates CVE-2026-108097 Critical, 19 out of 25 on Drupal's own scale, a remote code execution flaw in the core Field UI module: the vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules and at least one known path needs no authentication ([Drupal Security Team, 2026-10-14](https://www.drupal.org/sa-core-2026-014)). The advisory names no module that opens a path; The Hacker News reads the mechanism from the fix, where Field UI's table element ran whatever PHP callable each row carried in its #region_callback property through call_user_func_array with no check, bypassing the renderer's rule against untrusted callbacks, and 11.4.10 no longer calls it ([The Hacker News, 2026-10-15](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)).

Fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19; 11.2.x and below, 10.5.x and below, and Drupal 8 and 9 are end of life and get no fix, which The Hacker News counts at 28.5 percent of the sites reporting a core version in the week of 2026-10-04 ([The Hacker News, 2026-10-15](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)). The advisory records no public exploit at publication, but the Security Team's pre-announcement of 2026-10-12 told sites to reserve time "because exploits might be developed within hours or days", and in May Drupal reported exploit attempts within two days of a core SQL injection advisory that CISA then added to its Known Exploited Vulnerabilities catalog ([The Hacker News, 2026-10-15](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)). The contributed Entity List module has its own critical code-execution advisory, SA-CONTRIB-2026-218, under the same conditions, at least one known path needing no authentication, and 3.0.10 fixes it ([Drupal Security Team, 2026-10-14](https://www.drupal.org/sa-contrib-2026-218)); the flaw is CVE-2026-108099, and updating core does not update the module ([The Hacker News, 2026-10-15](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)).

**Exposure:** Drupal core on 10.6.x below 10.6.19, 11.3.x below 11.3.19 or 11.4.x below 11.4.10, or on an end-of-life branch from 8.9 to 11.2, with the Field UI module installed (the Standard install profile installs it) and a contributed module or custom code that exposes the vulnerable functionality, which the advisory does not name; Drupal Steward, a web application firewall service run by Acquia, Pantheon, Ironstar and Skpr, blocks some known vectors but not every one ([The Hacker News, 2026-10-15](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)).

**Detection:** the advisory publishes no exploit artifact. The result of the flaw is PHP code running as the web server's user, so as an inference from that, watch web access logs for unusual requests to routes that contributed modules provide, PHP worker process lineage for shells, curl or interpreters spawned by the web server, and new or modified PHP files under the web root and the Drupal files directory. An exposed site updated only after the fix was public needs that file-integrity review in addition to the update.

**Defender takeaway:** update core to the fixed release of its branch now, internet-facing sites first, because the flaw's mechanism is readable from the public fix and Drupal itself warned that exploits could follow within hours or days; where a site cannot be updated at once, uninstall Field UI, which removes the field management and display admin pages until the update ([The Hacker News, 2026-10-15](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)). Custom code that set #region_callback on a field_ui_table row stops working after the update, so test the manage fields and manage display pages ([The Hacker News, 2026-10-15](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)).