Drupal has released security updates to fix a critical remote code execution vulnerability that could allow attackers to take control of affected sites without signing in.
Tracked as CVE-2026-108097, the flaw is in the Field UI module in Drupal core. The Drupal Security Team published the advisory on October 14, 2026.
The official advisory (SA-CORE-2026-014) assigns the issue a risk score of 19 out of 25 under Drupal’s internal rating system. According to the advisory, successful exploitation could expose private site data and let attackers modify or delete information. That 19/25 rating is part of Drupal’s own scale and is not a CVSS score.
Drupal core by itself does not provide a direct exploitation path. However, the security team confirmed that several serious attack paths exist when certain contributed modules are present. Contributed modules are third‑party extensions that add features beyond the Drupal core.
At least one known attack path requires no authentication, meaning an attacker would not need a valid user account to exploit it. Custom site code can also expose the vulnerable functionality, so site owners should assess installed extensions and any bespoke development rather than judging risk solely by the Drupal version in use.
Critical Drupal remote code execution vulnerability
The public advisory does not identify the contributed modules involved or publish a working exploit. It describes exploitation as theoretical and notes there is no public exploit code or development documentation at this time. That language should not be taken as evidence the vulnerability is safe—confirmed attack paths have been described by the security team.
This advisory follows other recent Drupal security coverage, including a separate SQL injection issue in Drupal core. The exploitation status of that separate SQL injection report does not apply to the Field UI vulnerability, and the current advisory does not report active attacks in the wild for this issue.
Affected versions include Drupal 8.9.0 up to (but not including) 10.6.19; 11.0.0 up to (but not including) 11.3.19; and 11.4.0 up to (but not including) 11.4.10. Drupal 12 development releases from 12.0.0-alpha1 up to (but not including) 12.0.0-beta2 are also affected.
Because the vulnerability spans a wide range of releases, administrators should check every deployed site, particularly organizations that manage multiple Drupal installations.
Drupal recommends these updates: upgrade Drupal 11.4.x sites to 11.4.10, 11.3.x sites to 11.3.19, and 10.6.x sites to 10.6.19. Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, and Drupal 8 and 9 are no longer supported and do not receive security coverage.
Uninstalling the core Field UI module (field_ui) will protect a site while updates are prepared and applied. The Drupal Steward service blocks some known attack paths, but it does not cover every possible exploit; organizations using that service should still plan to upgrade rather than rely on filtering as a permanent mitigation.
Teams investigating potential compromise may find guidance on detecting and analyzing webshells useful, since webshells are malicious scripts that enable remote command execution. However, the immediate priority is clear: apply the supported security release or uninstall Field UI while preparing the update, and do not rely solely on partial network protections.
Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from 16K SOCs.
