Drupal core Field UI RCE is CVE-2026-108097: update to 11.4.10, 11.3.19 or 10.6.19

What happened

On 14 October 2026 the Drupal Security Team published SA-CORE-2026-014. It covers CVE-2026-108097, a remote code execution flaw in the core Field UI module.

Drupal rates it Critical 19/25. That is Drupal's own scale. NVD has no record for the CVE as of 18 October 2026, so there is no CVSS score yet.

The team pre-announced the release on 12 October. It warned that exploits might be developed within hours or days.

What is confirmed

• The flaw is in Field UI, the core module behind the admin pages that manage fields and their display.
• It is not directly exploitable with core alone.
• Drupal says multiple serious exploit paths exist with contributed modules. At least one known path needs no authentication.
• Custom code may also expose the vulnerable function.
• The advisory does not name the contributed modules.
• Fixed in Drupal 11.4.10, 11.3.19 and 10.6.19. Drupal 12.0.0-beta2 also has the fix and is not for production use.
• Drupal Steward blocks some known attack vectors. It does not cover all of them.
• The CVE is not in CISA KEV as of 18 October 2026.
• The advisory rates exploit status as theoretical. No public exploit and no attacks were reported as of 15 October 2026, per The Hacker News.

What is not known

• Which contributed modules open a path.
• Whether any attack is happening. ThreatWire found no public PoC and no reported exploitation.
• A CVSS score. NVD has not published one.
• Exact exposure counts. The Hacker News cites drupal.org usage data: for the week starting 4 October, 151,442 of 531,499 reporting sites (28.5%) ran an affected branch with no fix. ThreatWire did not check that data itself. It counts end-of-life branches, not every affected site.

Who should act

• Anyone running Drupal 10.6.x, 11.3.x or 11.4.x, or a 12 pre-release before 12.0.0-beta2.
• Anyone on Drupal 11.2.x or older, 10.5.x or older, 9 or 8. These get no patch. Plan a move to a supported release.
• Sites that use contributed modules or custom code around Field UI.
• Field UI is installed by Drupal's Standard profile, so many sites have it unless someone removed it (The Hacker News).

What to do now

1. Update to 11.4.10, 11.3.19 or 10.6.19, whichever matches your branch.
2. If you cannot update today, uninstall the core field_ui module. The field and display admin pages stop working until you reinstall it after patching.
3. Do not rely on Drupal Steward alone. It is partial cover.
4. Review contributed and custom modules that use Field UI. Retest the manage fields and manage display pages after the update.
5. Watch web server and application logs for unusual requests to Drupal admin and form endpoints.
6. If you run an end-of-life branch, treat the site as exposed and migrate.

Secondary reports also list a separate fix for the Entity List contributed module (3.0.10, CVE-2026-108099). Check the Drupal advisory page before you rely on that.

Sources: Drupal SA-CORE-2026-014, The Hacker News, OSV, NVD, CISA KEV.