The short version
Every supported Drupal 10 and 11 site should move to 10.6.19, 11.3.19 or 11.4.10 now. CVE-2026-108097, disclosed on October 14, 2026, is a critical remote code execution flaw in core’s Field UI module. Core alone is not exploitable, but common contributed modules open several paths, at least one without login. If Drupal runs your web application, patch this week.
What did Drupal disclose?
On October 14, 2026 the Drupal Security Team published SA-CORE-2026-014 for CVE-2026-108097, a remote code execution vulnerability in Field UI, the core module behind the admin screens where site builders add fields and arrange how content is displayed. The team scored it 19 out of 25 on its own risk scale: basic access complexity, no authentication required, and full read and write impact on site data. At publication it rated exploitation as theoretical.
The same release cycle shipped SA-CONTRIB-2026-218 for Entity List, a contributed module that builds entity listings without Views. Its flaw, CVE-2026-108099, carries the same Critical 19/25 rating and the same pattern: not exploitable by the module alone, but reachable through other modules, including at least one path without login. As BleepingComputer reported on October 17, the security team warned administrators that working exploits “might be developed within hours or days” of the release.
How does the Field UI flaw work?
Drupal builds its pages from render arrays, PHP structures that core later turns into HTML. Published technical analyses of the patch describe the root cause in Field UI’s table rendering: during the pre-render step, a PHP callable carried in each table row’s #region_callback property was executed without checking what that callable was. If an attacker can influence that property, they can make the server run a function of their choosing.
Core never hands that property to an anonymous visitor on its own, which is why the advisory says core alone is not exploitable. The risk comes from contributed modules and custom code that pass user-controlled data into render arrays. Drupal says “multiple serious exploit paths” exist this way, so the real exposure of any site depends on its module list, not its core version.
Which sites are exposed?
Every supported branch was affected: Drupal 10 from 8.9.0 onward up to 10.6.18, and Drupal 11 up to 11.3.18 and 11.4.9. Drupal powers more than a million websites, with heavy use by governments, universities, nonprofits and enterprise marketing teams in the US and EU. Sites on managed hosting still need the core update applied to their codebase and deployed.
The awkward group is anything still on Drupal 8 or 9. The vulnerable range starts at 8.9.0, but both versions are end-of-life and get no patch. For those sites the realistic options are uninstalling Field UI now and scheduling the upgrade that has probably been deferred for too long, which is a classic legacy modernization project rather than a one-line fix.
What it means for US & EU teams
The lesson goes beyond Drupal. Modern CMS and framework flaws increasingly live in the gap between a safe-looking core and the extensions bolted onto it. Your exposure is set by your dependency tree, so a current inventory of contributed modules, custom code and their versions is the first thing you need when an advisory like this lands. Teams without that inventory spend the first day of a critical patch just working out what they run.
For EU organizations under NIS2, and for public-sector sites that must follow national patch deadlines, a published critical RCE with an explicit “exploits within days” warning is exactly the kind of known risk auditors expect to see handled quickly and documented. Agencies that build and maintain Drupal sites for clients should confirm patch status across their whole portfolio, not just the flagship sites.
What to do this week
- Update core. Move to 10.6.19, 11.3.19 or 11.4.10 with
composer update drupal/core-recommended --with-dependencies, then run database updates and clear caches. - Update Entity List. If the module is installed, upgrade it to 3.0.10.
- Mitigate where you cannot patch. Uninstall Field UI (
drush pm:uninstall field_ui); field configuration stays in place and the module can be re-enabled after the update. - Inventory your modules. List every contributed module and custom module that builds render arrays from request data, and prioritise patching on sites with public forms or anonymous endpoints.
- Check end-of-life sites. Find any Drupal 8 or 9 installs, remove Field UI and put a dated upgrade plan in place.
- Watch your logs. Look for unusual requests to form and AJAX endpoints and for new PHP files or cron entries after October 14.
Frequently asked questions
What is CVE-2026-108097?
CVE-2026-108097 is a remote code execution vulnerability in the Field UI module of Drupal core, disclosed on October 14, 2026 in advisory SA-CORE-2026-014. The Drupal Security Team rates it Critical, 19 out of 25. It cannot be exploited with core alone, but contributed modules or custom code can expose it, and at least one known exploit path requires no authentication.
Which Drupal versions are affected and fixed?
Drupal 8.9.0 up to 10.6.18, Drupal 11.0.0 up to 11.3.18 and Drupal 11.4.0 up to 11.4.9 are affected. The fixed releases are 10.6.19, 11.3.19 and 11.4.10. Drupal 8 and 9 are end-of-life and receive no security fix.
Is CVE-2026-108097 being exploited?
At disclosure the Drupal Security Team rated exploitation as theoretical, and the coverage we reviewed through October 17, 2026 did not report attacks in the wild. The team did warn that exploits might be developed within hours or days, so sites should be patched without waiting for confirmed attacks.
What if we cannot update Drupal right away?
Uninstalling the core Field UI module (field_ui) protects a site while it waits for the update. Field configuration remains in place and the module can be re-enabled after patching. Drupal Steward offers partial protection only, so it is not a substitute for the update.
What is the Entity List vulnerability released alongside it?
On the same day Drupal published SA-CONTRIB-2026-218 for the Entity List contributed module. Its flaw, CVE-2026-108099, is also a Critical 19/25 remote code execution issue reachable through other modules, including at least one unauthenticated path. It is fixed in Entity List 3.0.10.
Sources
Drupal Security Team — SA-CORE-2026-014: Drupal core, Critical, Remote code execution (October 14, 2026)
Drupal Security Team — SA-CONTRIB-2026-218: Entity List, Critical, Remote code execution (October 14, 2026)
BleepingComputer — Drupal patches critical RCE flaws, warns exploits may emerge soon (October 17, 2026)
The Hacker News — Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules (October 2026)