Drupal RCE flaw fixed, older branches receive no patch
The Drupal RCE flaw in core's Field UI module can enable remote code execution, meaning an attacker may be able to run software commands on the website's server. Drupal released fixes on October 14 in versions 11.4.10, 11.3.19 and 10.6.19. The Drupal Security Team assigned CVE-2026-108097 a score of 19 out of 25 on the project's risk scale, placing it in the critical category.
Drupal says attackers cannot reach the vulnerable code through core alone. Exploitation instead depends on contributed modules, which are optional extensions developed outside Drupal core, or potentially custom code that exposes the affected function. The advisory does not identify the contributed modules involved, but confirms that several attack routes are known and at least one does not require the attacker to log in. This makes reviewing a site's complete collection of modules and custom integrations important, rather than treating the core update as the only consideration.
The supported fixes are Drupal 11.4.10 for the 11.4.x branch, 11.3.19 for 11.3.x and 10.6.19 for 10.6.x. Drupal 12.0.0-beta2 also contains the correction, although that beta is not intended for production websites. No patched release is available for Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, or Drupal 8 and 9 because those branches have reached end of life. Sites still running them need to move to a supported branch. Security coverage for both 11.3.x and 10.6.x is due to end in December 2026.
The scale of unsupported installations is significant. During the week beginning October 4, 151,442 of the 531,499 websites that reported their Drupal core version to drupal.org were running a branch that the advisory marks as affected but for which no fix was released. That represents 28.5% of the reporting sites. Field UI is also installed by Drupal's Standard installation profile, so sites created with that profile generally have the module unless an administrator has removed it.
Administrators who cannot update immediately can uninstall Field UI, whose machine name consists of the words field and ui joined by an underscore. Drupal says removing it protects the site while the update is being arranged, but the administrative pages used to manage fields and their display will be unavailable during that period. Drupal Steward, a web application firewall service using rules written by the Security Team, already blocks some known routes to the flaw. Acquia, Pantheon, Ironstar and Skpr operate that service for their customers, but the advisory stresses that it does not cover every possible route and is not a replacement for updating.
At publication, Drupal rated the vulnerability as having no publicly available exploit code. None had appeared by October 15, and neither the advisory nor public reporting had described attacks exploiting it. The Security Team had announced the planned release on October 12 and advised administrators to set aside time because working exploits could be created within hours or days. That warning reflected recent experience: in May, Drupal observed exploitation attempts within two days of disclosing a core Structured Query Language injection flaw limited to sites using the open-source relational database used by many web applications, and the US Cybersecurity and Infrastructure Security Agency later placed that earlier flaw in its catalog of exploited vulnerabilities.
The weakness was in the way Field UI constructed administrative tables from render arrays, which are PHP arrays that Drupal converts into web pages. Before the correction, a table's preparation step passed any PHP callable stored in a row's region callback property to PHP's array-based callable invocation function, causing that callable to run without checking what it was. A PHP callable is a reference to code that the application can execute.
Drupal's renderer has rejected untrusted render callbacks since version 8.8 in 2019, following earlier security advisories showing that the rendering system could invoke arbitrary callbacks too readily. In this case, the renderer trusted the table element's own methods, so it allowed the table preparation step to run and never applied its safety check to the second callable launched from that step. The affected call had been present since at least Drupal 8.9.0 in 2020.
In Drupal 11.4.10, the table code no longer executes that callback. It obtains each row's region directly from the row and, if the value does not match a known region, substitutes the table's hidden region or its first region. Core itself used the region callback property only in Field UI display forms. Custom code that assigned this property to a Field UI table row will stop receiving the callback after updating, so Pantheon advises testing the Manage fields and Manage display pages and checking affected custom code.
A related contributed extension, Entity List, received a separate critical remote code execution advisory under CVE-2026-108099. It has the same exploitation conditions, including a known route requiring no login. Entity List 3.0.10 applies a change that mirrors the Field UI correction. Updating Drupal core does not update this module separately. In the week starting October 4, 90 sites reported using Entity List.
The same Drupal core releases also correct two moderately critical cross-site scripting flaws, which could allow harmful page content to run in a visitor's browser. CVE-2026-108515 affects the Link module, while CVE-2026-108514 affects the Navigation module. Both require at least a logged-in user. Drupal 7 reached end of life on drupal.org in January 2025, although Pantheon says its Drupal 7 long-term support arrangement with Tag1 Consulting has released Drupal 7.107 with a backport of the Field UI fix.
For organisations that need assistance managing systems around website maintenance, AEU-I provides security-first IT, infrastructure and consulting. Regardless of supporting services or firewall rules, affected Drupal operators should install the appropriate fixed release, update Entity List separately where present, and test field-management pages and relevant custom code afterward.