Drupal patches critical RCE in Field UI module affecting core versions
Fixes released on October 14 address a critical remote code execution flaw in Drupal core that requires contributed modules to exploit.
Key points
- CVE-2026-108097 allows remote code execution via the Field UI module in specific Drupal core versions.
- Patches were released on October 14 for Drupal 11.4.10, 11.3.19, and 10.6.19.
- End-of-life versions including Drupal 8 and 9 have no available fix for this vulnerability.
The Drupal Security Team released patches on October 14 to address a critical remote code execution vulnerability tracked as CVE-2026-108097. The flaw resides in the Field UI module, a core component that manages how site builders configure and display fields.
Attackers cannot exploit this defect using only unmodified Drupal core software, according to the official advisory. However, several contributed modules create pathways to the vulnerability, with at least one known method requiring no user login credentials. The project rates the issue as critical, assigning it a score of 19 out of 25 on its internal risk scale.
Technical details and patch status
The security advisory credits Drew Webber and Octavio Galland with reporting the defect to the project maintainers. Fixes are available for Drupal 11.4.10, 11.3.19, and 10.6.19. The advisory notes that Drupal 12.0.0-beta2 contains the fix but is not intended for production environments.
No patch exists for Drupal 11.2.x and older versions, as well as 10.5.x and older. Additionally, Drupal 8 and 9 remain end-of-life and will not receive a correction. Both the 11.3.x and 10.6.x branches will lose official security coverage in December 2026.
Exposure and mitigation options
Data from drupal.org indicates that during the week starting October 4, approximately 151,442 sites were running affected branches without a fix. This represents 28.5% of the 531,499 sites that reported their core version to the registry.
Site administrators who cannot update immediately may uninstall the field_ui module to mitigate risk. The advisory states this action provides protection while updates are prepared, though it disables the admin pages for managing fields. Because Drupal’s Standard install profile includes Field UI by default, most sites have the module unless explicitly removed.
Current threat landscape
The Security Team pre-announced the release on October 12, warning administrators to reserve time for patching because exploits could emerge within hours or days. As of October 15, no public exploit code had surfaced, and no attacks using this flaw were reported.
Services like Drupal Steward, which operate as web application firewalls, already block some known vectors for this issue. Providers including Acquia, Pantheon, Ironstar, and Skpr run this service for their customers. The advisory emphasizes that this protection does not cover every potential exploit, so updating remains necessary.
What should you do?
Administrators should verify if their site runs an affected version of Drupal core and apply the latest patch immediately. If immediate updating is impossible, uninstalling the Field UI module can serve as a temporary protective measure. Organizations should monitor official security advisories for updates on exploit availability.
What to do and how to stay safe: Drupal
- Identify all Drupal instances in your environment and check their core versions against the affected list.
- Apply the specific security patches released on October 14 for versions 11.4.10, 11.3.19, and 10.6.19.
- Temporarily disable the Field UI module if you cannot patch immediately, understanding that field management features will be unavailable.
- Review contributed modules for potential exploit paths, as the vulnerability requires third-party code to be accessible.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Drupal versions are affected by CVE-2026-108097?
Drupal 10.6.x, 10.5.x and below, 11.3.x, 11.2.x and below, as well as end-of-life versions 8 and 9 are affected, though only 10.6.x, 11.3.x, and 11.4.x received patches.
Is there a public exploit for this vulnerability?
No, the advisory stated that no publicly available exploit code existed as of October 15, and no attacks were reported at that time.
Can I fix this issue on Drupal 8 or 9?
No, Drupal 8 and 9 are end-of-life versions and do not receive security patches for this or other vulnerabilities.
