Drupal said on October 14 that it fixed a critical Field UI remote code execution flaw, CVE-2026-108097, in Drupal 11.4.10, 11.3.19, and 10.6.19, and that at least one known exploit path needs no login. The core bug sits in the Field UI admin feature, but Drupal said core alone is not directly reachable.
The catch is the route in: contributed modules or custom code can reach the privileged workflow indirectly, so an attacker can sidestep the admin-only surface through the site’s own extensions. That means patching core is necessary but does not fully describe exposure if a site’s module stack reopens the path.
For teams running Drupal with plugins, custom modules, or site-specific code, the question is not only whether core is current, but whether anything around it still exposes Field UI. Sites built from the Standard profile inherit that surface unless someone removed it.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.