The Drupal Security Team released fixes on October 14 for a critical remote code execution flaw in Drupal core’s Field UI module, tracked as CVE-2026-108097. Drupal rates it 19 out of 25 on its risk scale. Core alone does not expose the bug: the advisory says it can be reached through contributed modules, and at least one known path needs no login. Custom code may also open a path. The advisory does not name the modules involved.
According to The Hacker News, the problem is in how Field UI builds its admin tables. Before the fix, a table row’s #region_callback value was run as a PHP callable without checking what it was, and Drupal’s renderer check for untrusted callbacks never reached it. The fixed releases stop calling that value and read each row’s region directly. The advisory lists no public exploit code at publication, and neither the advisory nor the reporting describes attacks. The Security Team pre-announced the release on October 12 and warned that “exploits might be developed within hours or days.” Drupal’s Entity List contributed module received its own critical advisory, CVE-2026-108099, with the same conditions.
How to check if you’re affected
Affected versions per the advisory are Drupal core from 8.9.0 up to but not including 10.6.19, 11.3.19 and 11.4.10, plus 12.0.0 alpha releases before 12.0.0-beta2. Affected products also include the Entity List module before version 3.0.10 (CVE-2026-108099). Drupal 8 and 9, 10.5.x and older, and 11.2.x and older are end of life and receive no fix.
- Check your core version in Reports > Status report, then update to 11.4.10, 11.3.19 or 10.6.19 for your branch. The 12.0.0-beta2 release is not for production use.
- If you cannot update yet, uninstalling the Field UI module (
field_ui) protects the site until you do. The pages for managing fields and their display will be unavailable while it is uninstalled. Sites built from the Standard install profile have Field UI unless it was removed. - Update Entity List to 3.0.10 or later if you use it.
- Sites behind Drupal Steward (run by Acquia, Pantheon, Ironstar and Skpr) get rules that block some known attack vectors, but the advisory says they should still update.
The same core releases fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514).