DRUPAL has patched a critical unauthenticated RCE flaw in its Field UI core module (CVE-2026-108097) that could be exploited via contributed modules and custom code. The Drupal Security Team says an attacker cannot reach the flaw through core alone; exploitation paths exist through third‑party modules, with at least one known path requiring no login. The fixes were released on 14 October 2026 for the affected branches: 11.4.10, 11.3.19 and 10.6.19.
The advisory notes that the vulnerability resides in Field UI, which underpins admin pages used to manage fields and their display. In addition, the Entity List module received its own advisory (CVE-2026-108099) with a similar unauthenticated remote code execution path, and two moderately critical XSS flaws in the Link and Navigation modules (CVE-2026-108515 and CVE-2026-108514) were fixed in the same core releases.
Evidence and impact metrics cited by Drupal indicate that in the week beginning 4 October 2026, 151,442 of 531,499 sites (28.5%) reporting a Drupal core version were on a branch listed as affected and not yet fixed. The advisory recommends immediate updating of supported branches or, if updating is not possible, uninstalling the Field UI module (field_ui) to provide protection while sites are updated, noting that the admin pages for field management become unavailable during the uninstall.
Drupal Steward (a web application firewall service) already blocks some vectors, but sites should still apply the fixes. The advisory also emphasises that custom code setting the region_callback in Field UI render rows will no longer execute after the update.