The Drupal Security Team has disclosed a critical vulnerability in Drupal core that could allow attackers to execute malicious code on affected websites. The flaw can be exploited without authentication under certain conditions, potentially exposing websites to unauthorized access and server compromise.
Tracked as CVE-2026-108097, the vulnerability was disclosed on October 14, 2026, in security advisory SA-CORE-2026-014. Drupal assigned it a critical severity rating of 19 out of 25 on its security risk scale.
The issue affects the Field UI module, a built-in Drupal component that allows administrators to manage content fields and their display settings. While the vulnerability cannot be directly exploited through Drupal core alone, the security team confirmed that interactions with certain contributed modules create several possible attack paths. Custom code may also expose the vulnerable functionality.
How the Vulnerability Could Be Exploited
Remote code execution (RCE) vulnerabilities can allow attackers to run unauthorized code on a targeted server. Depending on the permissions available to the affected application, successful exploitation could enable attackers to modify website content, access sensitive information, or compromise the underlying system.
According to Drupal’s security advisory, multiple serious exploitation paths exist when the vulnerable Field UI functionality interacts with contributed modules. At least one known attack path does not require authentication, meaning an attacker could potentially exploit an affected website without signing in.
The risk depends on which modules and custom functionality a website uses. Drupal installations running the vulnerable core versions are not necessarily exploitable in their default configuration, but websites using affected extensions may be exposed.
The vulnerability was reported by Drew Webber of the Drupal Security Team and security researcher Octavio Galland.
Affected Drupal Versions and Security Updates
The vulnerability affects several supported and older Drupal releases, including Drupal 10, 11, and certain Drupal 12 development versions.
Drupal has released security updates for the supported branches:
- Drupal 11.4.x: Update to version 11.4.10
- Drupal 11.3.x: Update to version 11.3.19
- Drupal 10.6.x: Update to version 10.6.19
Drupal 12 development releases from 12.0.0-alpha1 through versions earlier than 12.0.0-beta2 are also affected, with the issue fixed in beta2.
Older releases, including Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, and Drupal 8 and 9, have reached end-of-life and no longer receive regular security coverage. Websites running these versions should migrate to a supported release.
For administrators unable to install updates immediately, Drupal recommends uninstalling the core Field UI module (field_ui) as a temporary mitigation. This prevents exploitation of the affected functionality while the website is being updated.
Drupal also confirmed that websites using Drupal Steward, its automated security protection service, are protected against some known attack methods. However, the service does not cover every possible exploitation path, and administrators are still advised to apply the security updates.
Website owners and administrators should review their installed Drupal versions, assess their use of contributed modules, and deploy the appropriate patched release as soon as possible.
Leave a Reply