Summary
- CVE-2026-108097 affects the Field UI module but is not directly exploitable through Drupal core alone.
- Contributed modules or custom code can expose several paths, at least one unauthenticated.
- Supported Drupal 10 and 11 branches have separate fixed versions; older branches are unsupported.
Drupal has issued critical security updates for a remote code execution vulnerability in its Field UI module, warning that certain contributed modules and custom implementations can make an attack possible without an authenticated account.
The 14 October advisory, SA-CORE-2026-014, assigns the issue CVE-2026-108097. Drupal’s security team describes multiple potentially serious exploitation paths, but explicitly states that the weakness is not directly exploitable with Drupal core alone. At least one known path involving other software does not require authentication.
Drupal installations commonly combine core software with contributed modules and site-specific code. An extension can create an unsafe path into a vulnerable core function even where the base installation does not expose that function directly. The affected modules and their permissions therefore determine whether an unauthenticated party can reach the flaw.
The advisory identifies fixed releases for supported lines: 10.6.19 for Drupal 10.6, 11.3.19 for Drupal 11.3, and 11.4.10 for Drupal 11.4. Older Drupal 10 and 11 lines are outside their stated security coverage, as are the long-retired Drupal 8 and 9 branches. The published fix therefore cannot be reduced to one version number applicable to all deployments.
Drupal also advises that removing the core Field UI module can mitigate this particular vulnerability while an installation is being updated. That action has possible administration consequences depending on how a site is built, so it does not replace evaluating the relevant application and completing an appropriate upgrade.
Some sites are protected against known attack paths through Drupal Steward, a service intended to provide an additional defensive layer for supported installations. The Drupal security team warns that this protection is not comprehensive and may not cover other exploitation routes. It does not regard enrolment in the service as a substitute for updating affected core software.
A remote execution vulnerability in a content management system can expose far more than public web pages if an attacker gains code execution in the server’s operating context. Potential consequences depend on hosting privileges, accessible files, network connectivity, and deployment design. Drupal’s disclosure does not confirm that every vulnerable site was compromised or that attacks are occurring across the internet.
Organisations often have separate responsibilities for CMS hosting, site administration, and the contributed modules used by editorial or business teams. Determining exposure requires an inventory that includes both installed modules and custom integrations. The presence of a patched core release does not guarantee that unrelated custom code has been reviewed for other weaknesses.
The critical Field UI advisory appeared alongside additional Drupal core fixes for cross-site scripting problems. Those separate issues affect different components and should not be conflated with the conditional remote execution route. The release notes provide the appropriate patch line and describe end-of-life versions that no longer receive security updates.
The security release includes separate fixes for cross-site scripting weaknesses as well as Field UI. An organisation that updates to the corrected branch receives multiple changes at once, yet the vulnerabilities differ materially. Cross-site scripting generally concerns browser execution in a user’s security context, while the conditional Field UI flaw can reach code execution on the server when combined with affected modules or custom code. Keeping those paths separate helps incident responders avoid attributing a suspicious browser event to a server-side flaw without evidence. It also explains why a configuration-based mitigation for Field UI does not remove the need to review the other vulnerabilities included in the same Drupal release.
Drupal credits security researchers and community maintainers with reporting, fixing, and coordinating the issue. Its public advisory offers a defined remediation route, but the extent of actual deployment exposure depends on the combinations of modules and site-specific code installed by each operator.
