Drupal Field UI RCE CVE-2026-108097: public lab PoC released

What happened

On 14 October 2026, the Drupal Security Team published SA-CORE-2026-014. It fixes CVE-2026-108097, a remote code execution flaw in the core Field UI module.

On 18 October 2026, the security firm Fortbridge published a research repository on GitHub. It contains a lab PoC, test scripts and a write-up of the evidence. ThreatWire read the repository's description and file list. ThreatWire has not run it.

Who is affected

Drupal lists these affected ranges: 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, and 11.4.0 to before 11.4.10. Drupal 12 pre-releases before 12.0.0-beta2 are also affected.

The fixed releases are 11.4.10, 11.3.19 and 10.6.19. Drupal 11.2.x and older, 10.5.x and older, 9 and 8 are end of life. They get no fix.

A site is only exposed if a contributed module or custom code reaches the flaw. Drupal says core alone is not directly exploitable.

What is confirmed

• Advisory. Drupal rates the flaw Critical 19/25 on its own risk scale. The risk vector marks exploitation as theoretical.
• Access. Drupal says at least one known exploit path needs no authentication. The advisory does not name a required permission.
• Modules. Drupal says multiple serious exploit paths exist through contributed modules. It does not name them.
• Entity List. The same day, Drupal fixed a related flaw in the Entity List contributed module. That is SA-CONTRIB-2026-218 (CVE-2026-108099), fixed in 3.0.10.
• Mitigation. Uninstalling the core Field UI module blocks the flaw until you patch. Drupal Steward covers some attack paths, not all.
• PoC. The Fortbridge repository holds a real lab exploit chain. It runs against a vulnerable 11.4.9 site and a patched 11.4.10 site in local containers.
• KEV. The CVE is not in the CISA KEV catalog as of 20 October 2026.

What is not confirmed

• The real-world path. The PoC uses a synthetic helper module. That module stands in for the unnamed contributed code that would let a web request reach the flaw. Fortbridge says it found no public module that does this, apart from Entity List.
• Researcher claims. Fortbridge says its lab chain reached file disclosure and command execution on the vulnerable site. It says the patched site blocked every variant. ThreatWire has not verified this.
• Score. NVD has no record for this CVE as of 20 October 2026. No CVSS score is published.
• Attacks. No official source reports exploitation in the wild.
• Your exposure. It depends on your contributed and custom modules. For any given site, that stays Unknown until you review them.

What to do now

1. Update to 11.4.10, 11.3.19 or 10.6.19, whichever matches your branch.
2. If you use Entity List, update it to 3.0.10.
3. If you cannot patch today, uninstall the core Field UI module. Reinstall it after the update.
4. Review custom modules that build Field UI tables. Ask your developers whether request data can reach them.
5. Move off end-of-life branches. They will not get this fix.

Sources: Drupal SA-CORE-2026-014, Drupal SA-CONTRIB-2026-218, NVD, the CISA KEV catalog and the Fortbridge research repository. Links are in the references list.