Vulnerabilities · 2h ago
Drupal said on October 14 that it fixed a critical Field UI remote code execution flaw, CVE-2026-108097, in Drupal 11.4.10, 11.3.19, and 10.6.19, and that at least one known exploit path needs no login. The core bug sits in the Field UI admin feature, but Drupal said core alone is not directly reachable.
The catch is the route in: contributed modules or custom code can reach the privileged workflow indirectly, so an attacker can sidestep the admin-only surface through the site’s own extensions. That means patching core is necessary but does not fully describe exposure if a site’s module stack reopens the path.
For teams running Drupal with plugins, custom modules, or site-specific code, the question is not only whether core is current, but whether anything around it still exposes Field UI. Sites built from the Standard profile inherit that surface unless someone removed it.
4 sources covering this story
Kwetsbaarheden verholpen in Drupal Core en modules door Drupal
De kwetsbaarheden betreffen meerdere modules binnen Drupal.
Rilevate vulnerabilità in Drupal
Rilevate 3 vulnerabilità, di cui una con gravità "critica", in Drupal, noto Content Management System (CMS) open source.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal patched a critical Field UI RCE flaw reachable through contributed modules, including one known path that requires no login.
Part of the PlainSec briefing for 2026-10-19