An urgent remote code execution vulnerability discovered in the Field UI module of Drupal core could allow attackers to compromise websites without needing to log in. The bug, designated CVE-2026-108097, was officially disclosed on October 14, 2026, and carries a severity rating of 19 out of 25 under Drupal’s internal risk system. Exploitation could open access to private data and enable attackers to modify or delete site content.
What Sites Are Affected
The vulnerability impacts multiple major branches of Drupal: all versions from 8.9.0 up to but not including 10.6.19; 11.0.0 through 11.3.x before 11.3.19; and 11.4.0 before 11.4.10. Also vulnerable are development builds of Drupal 12 from 12.0.0-alpha1 to just before 12.0.0-beta2. Systems running Drupal 8 or 9, or those on branches no longer supported for security updates (such as 11.2.x and earlier or 10.5.x and earlier) are also at risk.
Exploit Paths & Mitigation Options
Although the Field UI module is in Drupal core, the core alone doesn’t always provide a path for attackers to exploit this flaw. In many real-world scenarios, additional contributed modules or custom code can expose the vulnerability—even when no valid Drupal user account is involved. In those cases, an attacker may achieve full control without authentication.
Drupal recommends site administrators immediately apply one of the patched releases: upgrade to 10.6.19 if running 10.6.x; 11.3.19 for 11.3.x; or 11.4.10 for 11.4.x. In the meantime, temporarily uninstalling the Field UI (field_ui) module can block many attack paths, though not all. Organizations using configuration or defense services (for example, filtering or blocking via external protections) should not treat them as permanent fixes.
The advisory makes clear that while there is no proof yet of routine real-world attacks exploiting this flaw, the paths for doing so are confirmed. Details on contributing modules tied to active exploit routes have not been released.
Administrators should also review custom code, audit all installed extensions, and examine sites for possible web shells or signs of breach. The severity of this flaw demands action for anyone managing Drupal sites – regardless of version.
What this means: This vulnerability underscores how modules outside of core can dramatically broaden the attack surface for popular platforms like Drupal. With core alone not enough to restrict risk, third-party extensions and custom code become critical variables. Watch for future advisories naming specific exploit paths, keep all versions updated, restrict module use to trusted ones, and consider more aggressive isolation for critical site functions. The gap between official fixes and practical exposure (due to extensions or custom code) is a fault line many site maintainers will likely come to regret if ignored.
