CVE-2026-108097
Drupal core Field UI remote code execution (SA-CORE-2026-014)
Drupal SA-CORE-2026-014 covers a remote code execution flaw in the core Field UI module. Core alone is not directly exploitable, but contributed modules expose it and at least one known path needs no login. Drupal rates it Critical 19/25. Fixed in 11.4.10, 11.3.19 and 10.6.19. No NVD score yet. Not in CISA KEV as of check. No public PoC confirmed.
By ThreatWire Desk · Published 14 Oct 2026 · Updated 18 Oct 2026
- CVSS
- Unknown
- Vector
- Not recorded
- Class
- RCE
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Drupal
- Products
- Drupal core (Field UI module)
- Affected
- 8.9.0 up to before 10.6.19; 11.0.0 up to before 11.3.19; 11.4.0 up to before 11.4.10; 12.0.0-alpha1 up to before 12.0.0-beta2. Drupal 11.2.x and older, 10.5.x and older, 9 and 8 are end of life and get no fix.
- Fixed
- Drupal 11.4.10, 11.3.19 and 10.6.19 (14 October 2026). Drupal 12.0.0-beta2 includes the fix and is not for production use. Temporary mitigation from the advisory: uninstall the core Field UI module (field_ui).
- CWE
- Not recorded
- Published
- 14 Oct 2026
- Updated
- 18 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-108097 is a remote code execution flaw in the Field UI module of Drupal core. The Drupal Security Team published it as SA-CORE-2026-014 on 14 October 2026.
Drupal rates it Critical 19/25 (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default). That is Drupal's own scale, not a CVSS score. NVD has no record for this CVE as of 18 October 2026, so no CVSS score is published yet.
The advisory says the flaw is not directly exploitable with core alone. It says multiple serious exploit paths exist with contributed modules and that at least one known path does not require authentication. Custom code may also expose the vulnerable function. The advisory does not name the modules.
Fixed versions are Drupal 11.4.10, 11.3.19 and 10.6.19. Drupal 12.0.0-beta2 also has the fix. Drupal 11.2.x and older, 10.5.x and older, 9 and 8 are end of life and get no patch.
Drupal's temporary mitigation is to uninstall the core Field UI module (field_ui). Drupal Steward already blocks some known attack vectors. It does not cover every possible exploit.
The CVE is not in the CISA KEV catalog as of 18 October 2026. The advisory rates exploit status as theoretical. No public exploit and no attacks were reported as of 15 October 2026 (The Hacker News). ThreatWire found no public PoC. Drupal pre-announced the release on 12 October and warned that exploits might be developed within hours or days.
What to do: update to a fixed release now. If you cannot, uninstall field_ui until you can. Review contributed and custom code that touches the Field UI API.