Drupal core SA-CORE-2026-014 / CVE-2026-108097 (critical 19/25): Field UI remote code execution — not reachable via core alone, but contributed modules open paths including one unauthenticated; fixed in 11.4.10, 11.3.19, 10.6.19
The Drupal Security Team published SA-CORE-2026-014 on 14 October 2026 for CVE-2026-108097, a remote code execution flaw in the core Field UI module (the admin UI for managing fields and their display). Drupal rates it Critical 19/25 (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default). The advisory says the issue is not directly exploitable with core alone, but multiple serious exploit paths exist through contributed modules, and at least one known path needs no authentication; custom code may also expose the vulnerable functionality. Mitigate immediately by uninstalling the core field_ui module while preparing the upgrade. Fixed releases: Drupal 11.4.10, 11.3.19, 10.6.19, and 12.0.0-beta2 for the 12.0 beta line (beta branch only). Drupal 11.2.x and below, 10.5.x and below, and Drupal 8/9 are end-of-life and receive no fix. Drupal Steward is described as protecting some known attack vectors but not all. Reported by Drew Webber of the Security Team and Octavio Galland. Primary: Drupal SA-CORE-2026-014.
- Product
- Drupal core (Field UI module field_ui)
- Versions
- Affected: >=8.9.0 <10.6.19; >=11.0.0 <11.3.19; >=11.4.0 <11.4.10; >=12.0.0-alpha1 <12.0.0-beta2. Fixed: 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2. EOL branches (11.2.x and below, 10.5.x and below, Drupal 8/9) have no fix.
- CVSS
- Drupal critical 19/25 (no NVD CVSS published on the advisory page at verification)
- Exploited in Australia?
- unknown
- Patch to
- Update Drupal to 11.4.10, 11.3.19 or 10.6.19 as applicable. Until then, uninstall the core Field UI module (field_ui) to mitigate. Inventory contributed modules that touch Field UI admin paths, and treat unauthenticated Field UI exposure as urgent.
Primary: Drupal.org — SA-CORE-2026-014: Field UI remote code execution (CVE-2026-108097, 14 Oct 2026) · Vendor: Drupal Security Advisories · CVE: CVE-2026-108097 · The Hacker News — Drupal Patches Critical Field UI Flaw (15 Oct 2026)