Drupal warns of critical Field UI RCE in core (CVE-2026-108097)
Original title: Drupal Warns Critical RCE Flaw Could Let Unauthenticated Attackers Compromise Websites
Core alone is not directly exploitable, but at least one contributed-module path needs no login.
Drupal advisory SA-CORE-2026-014, published October 14, 2026, warns that CVE-2026-108097 in the core Field UI module can allow remote code execution. Drupal scores the risk 19 out of 25, with basic complexity, no authentication required on a known path, and full confidentiality and integrity impact. Core by itself does not expose a direct route; contributed modules or custom code can, and exploit status is listed as theoretical. Fixed releases are 10.6.19, 11.3.19 and 11.4.10. Uninstalling field_ui is the stated mitigation.
Unconfirmed: Drupal lists exploitation as theoretical and has not confirmed attacks or named the contributed modules.
- Affected ranges run from 8.9.0 before 10.6.19, 11.0.0 before 11.3.19, and 11.4.0 before 11.4.10.
- Drupal 12 builds from 12.0.0-alpha1 before 12.0.0-beta2 are also listed.
- Drupal 10.5.x and earlier, 11.2.x and earlier, and Drupal 8 and 9 are unsupported.
- Drupal Steward blocks some known paths but not every possible exploit.
- Drew Webber and Octavio Galland are credited with the report.
Impact: Remote code execution that can expose or change site data
| Product | Affected | Fixed in |
|---|---|---|
| Drupal core Field UI | 8.9.0 to before 10.6.19; 11.0.0 to before 11.3.19; 11.4.0 to before 11.4.10; 12.0.0-alpha1 to before 12.0.0-beta2 | 10.6.19, 11.3.19, 11.4.10 |
- 1.Install Drupal 10.6.19, 11.3.19, or 11.4.10 for the matching branch.
- 2.Uninstall the core Field UI module (field_ui) until the site is updated.
- CVEs
- CVE-2026-108097
- Vendors
- Drupal
- Products
- Field UI
- Organizations
- Drupal Security Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — |
From the original article
3 min read at gbhackers.com
Drupal has warned of a critical remote code execution vulnerability that could let attackers compromise affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core and received a security risk score of 19 out of 25 in an advisory published on October 14, 2026. The key detail […]
By Tushar Subhra · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.