Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Drupal warns of critical Field UI remote code execution, CVE-2026-108097, including an unauthenticated contributed-module path.
Drupal published SA-CORE-2026-014, a critical remote code execution vulnerability in the Field UI module tracked as CVE-2026-108097, with a security risk score of 19 out of 25. Core by itself is not directly exploitable, but contributed modules create multiple serious paths, including at least one that requires no authentication; custom code may also expose it. The advisory lists affected core lines from 8.9.0 through stated 11.x releases and 12.0.0-alpha1 before 12.0.0-beta2, and rates exploitation theoretical.
- CVE-2026-108097 is a critical remote code execution flaw in Drupal Field UI.
- Core alone is not directly exploitable, but contributed modules create serious paths.
- At least one known path does not require authentication.
- Drupal rates exploitability theoretical and risk 19 out of 25.
- CVEs
- CVE-2026-108097
- Vendors
- Drupal
- Products
- Drupal coreField UI
- Organizations
- Drupal
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — |
From the original article
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: >= 8. 9. 0 = 11.
By Drupal Security Team · drupal.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.