Drupal Field UI flaw can allow unauthenticated takeover (CVE-2026-108097)
Original title: Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication
Core alone is not directly exploitable, but contributed modules or custom code can open unauthenticated paths; no public exploit is reported.
Drupal patched CVE-2026-108097, a critical remote code execution bug in the Field UI module, in advisory SA-CORE-2026-014, rated 19 of 25. Core alone does not offer a direct exploit path, but contributed modules or custom code can, including at least one unauthenticated path. Drupal calls exploitation theoretical, with no public exploit and no reported attacks. Fixes are 10.6.19, 11.3.19 and 11.4.10.
Unconfirmed: The advisory does not name the contributed modules that create attack paths and reports no in-the-wild attacks.
- Affected ranges include 8.9.0 before 10.6.19 and 11.4.0 before 11.4.10.
- Drupal 12 builds from 12.0.0-alpha1 before 12.0.0-beta2 are also affected.
- Drupal 8, 9, 10.5.x and earlier, and 11.2.x and earlier lack security coverage.
- Uninstalling the core Field UI module protects sites until they are updated.
- Drupal Steward blocks some attack paths but does not replace upgrading.
Impact: Unauthenticated remote code execution and access to private site data
| Product | Affected | Fixed in |
|---|---|---|
| Drupal core Field UI | 8.9.0 before 10.6.19; 11.0.0 before 11.3.19; 11.4.0 before 11.4.10; 12.0.0-alpha1 before 12.0.0-beta2 | 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 |
- 1.Install Drupal 10.6.19, 11.3.19, or 11.4.10 for the matching supported branch.
- 2.Uninstall the field_ui module while preparing the security update.
- 3.Do not rely on Drupal Steward alone; it does not cover every path.
- CVEs
- CVE-2026-108097
- Vendors
- Drupal
- Products
- Field UI
- Organizations
- Drupal Security Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — |
From the original article
2 min read at cybersecuritynews.com
Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.