Drupal has released security updates to address a critical remote code execution vulnerability in its core Field UI module that could allow attackers to execute arbitrary code on a website’s server under certain conditions.
Tracked as CVE-2026-108097, the flaw was patched on October 14, 2026, with the release of Drupal 11.4.10, 11.3.19, and 10.6.19. The Drupal Security Team warns that although the vulnerability cannot be exploited through Drupal core alone, contributed modules or custom code can expose attack paths, including at least one known path that does not require authentication.
The vulnerability affects Field UI, a core Drupal module that provides administrative interfaces for managing website fields and their display settings. Drupal assigned the flaw a risk score of 19 out of 25 on its own severity scale, classifying it as critical.
According to the security advisory, the issue stems from how Field UI processes administrative tables built using Drupal’s render system. Before the fix, the module could execute a PHP callback supplied through a table row’s #region_callback property without validating the callback. This behavior could allow an attacker to trigger arbitrary code execution when a vulnerable contributed module or custom implementation exposed the affected functionality.
The Drupal Security Team credited Drew Webber and Octavio Galland with reporting the vulnerability. At the time of the advisory, Drupal said no public exploit code was available, and reports published through October 15 had not identified confirmed exploitation of this specific flaw.
Administrators should upgrade to a fixed release as soon as possible. Drupal 11.4 users should install version 11.4.10, Drupal 11.3 users should upgrade to 11.3.19, and Drupal 10.6 users should install 10.6.19. A Drupal 12.0.0 beta fix is also available in beta2, but beta releases are not intended for production websites.
Older branches, including Drupal 11.2 and earlier, Drupal 10.5 and earlier, and Drupal 8 and 9, are no longer supported and do not have fixes listed in the advisory. Websites running these versions should prioritize moving to a supported release.
For sites that cannot update immediately, the security team recommends uninstalling the Field UI module as a temporary mitigation. This disables the administrative pages used to manage fields and their display settings. Administrators should also review contributed modules and custom code that interact with Field UI tables.
Drupal Steward, a web application firewall service that uses rules developed by the Drupal Security Team, blocks some known attack paths. However, the service does not cover every possible exploitation method, and Drupal still recommends applying the official updates.
The potential exposure is significant. During the week beginning October 4, 2026, 151,442 of the 531,499 websites that reported their Drupal core version to Drupal.org were running branches identified as affected but without a fix available for those versions. That represented approximately 28.5% of reporting sites.
The patch changes how Field UI determines table row regions. Instead of executing the callback, the fixed code reads the region value directly from each row and falls back to a valid default region when necessary. This removes the unsafe callback execution path.
Administrators should also check the Entity List contributed module, which received a separate critical remote code execution advisory, CVE-2026-108099. Its fixed release, version 3.0.10, must be installed separately because updating Drupal core does not automatically update contributed modules.
The same Drupal core releases also address two moderately critical cross-site scripting vulnerabilities affecting the Link module (CVE-2026-108515) and Navigation module (CVE-2026-108514). Both require an authenticated user, according to the advisories.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Drupal site owners should review their installed core and contributed module versions, apply the relevant security updates, and test field-management pages and custom integrations after patching. Because the security team warned that exploit code could emerge quickly, delaying updates could leave vulnerable websites exposed to future attacks.
Drupal Fixes Critical RCE Vulnerability That Could Put Websites at Risk
