Drupal Field UI RCE CVE-2026-108097 Requires Contributed Modules for Access

Drupal core contains a critical remote code execution flaw in its Field UI module, tracked as CVE-2026-108097. The Drupal Security Team released patches on October 14 for supported branches, warning that exploit development could begin within hours of disclosure.

What happened

The vulnerability resides in the Field UI module, which manages admin pages for field configuration and display settings. According to the Drupal Security Team, attackers cannot trigger this flaw using core components alone. Exploitation requires the presence of specific contributed modules or custom code that creates an attack surface.

At least one known exploitation path does not require prior authentication, allowing unauthenticated attackers to run code on the server. The advisory rates the issue 19 out of 25 on Drupal’s risk scale, classifying it as critical. Drew Webber and Octavio Galland are credited with reporting the security issue to the project maintainers.

Patches were shipped for Drupal 11.4.10, 11.3.19, and 10.6.19. Drupal 12.0.0-beta2 is also noted, though it is not intended for production use. No fixes exist for Drupal 11.2.x and below, 10.5.x and below, or end-of-life versions 8 and 9. Both 11.3.x and 10.6.x branches lose security coverage in December 2026.

Why it matters

A significant portion of the Drupal ecosystem remains exposed to this critical flaw. In the week starting October 4, data from drupal.org showed that 151,442 sites were running affected branches without a fix. This represents 28.5% of the 531,499 sites that reported their core version to the registry.

The Field UI module is included by default in Drupal’s Standard install profile. Unless a site builder explicitly removed it, most standard installations contain the vulnerable component. While the advisory stated no public exploit code existed at publication, the team urged immediate updates due to the rapid development timeline of potential attacks.

Sites unable to update immediately can uninstall the field_ui module to mitigate risk. This action disables the admin pages for managing fields and their display, providing protection while updates are prepared. The Drupal Steward web application firewall service, used by providers like Acquia and Pantheon, blocks some known vectors but does not cover all possible exploits.

What to watch

• Verify if your site uses the Standard install profile, which includes the vulnerable Field UI module by default.
• Check if your Drupal version is 11.4.10, 11.3.19, or 10.6.19 to confirm patch status.
• Monitor for any new public exploit code or proof-of-concept releases following the advisory.
• Review custom code and contributed modules that interact with field management interfaces.

Signals worth monitoring

Security teams should examine web server access logs for unusual POST requests targeting field configuration endpoints, particularly from unauthenticated sources. Look for spikes in server resource usage or unexpected process spawns that may indicate remote code execution attempts. Check for new files or modified scripts in directories writable by the web server. If anomalies appear, isolate the affected instance immediately and review recent deployment changes to identify potentially vulnerable contributed modules.

What to do and how to stay safe: Drupal

• Update Drupal core to 11.4.10, 11.3.19, or 10.6.19 as soon as possible to apply the official patch.
• If immediate updating is impossible, uninstall the field_ui module to disable the vulnerable interface.
• Review installed contributed modules for any that interact with field UI functionality, as these may provide exploit paths.
• Ensure your web application firewall rules are updated to block known attack vectors associated with this CVE.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Can this vulnerability be exploited without logging into the Drupal admin panel?

Yes, the Drupal Security Team confirmed that at least one known exploitation path for this flaw requires no login credentials.

Which Drupal versions are not receiving a fix for CVE-2026-108097?

No fixes are available for Drupal 11.2.x and below, 10.5.x and below, or the end-of-life versions 8 and 9.

Is public exploit code for this vulnerability currently available?

As of October 15, no public exploit code had surfaced, and neither the advisory nor public reports described active attacks using this flaw.