Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.
Drupal patched critical Field UI flaw CVE-2026-108097, rated 19 of 25, in core releases 11.4.10, 11.3.19, and 10.6.19 on October 14. The bug is not reachable through core alone, but contributed modules can expose it, and at least one known path requires no login. Drupal said no public exploit existed at publication, and no attacks had been reported by October 15. The same releases fix XSS issues CVE-2026-108515 and CVE-2026-108514, while the Entity List module has separate critical RCE CVE-2026-108099.
- CVE-2026-108097 is a critical Field UI remote code execution flaw.
- Core alone is not exposed; one contributed path needs no login.
- Fixed releases are 11.4.10, 11.3.19, and 10.6.19.
- No public exploit or observed attacks were reported as of October 15.
- Related flaws include Entity List RCE CVE-2026-108099 and two XSS bugs.
- Vendors
- Drupal
- Products
- DrupalField UIEntity List
- Organizations
- DrupalDrupal Security TeamAcquiaPantheon
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — | |
| CVE-2026-108099 | — | — | — | ||
| CVE-2026-108514 | — | — | — | ||
| CVE-2026-108515 | — | — | — |
From the original article
4 min read at thehackernews.com
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11. 4. 10, 11.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.