Drupal has fixed a critical remote code execution flaw in its core Field UI module, and on at least one known path, an attacker does not need to log in to use it. Drupal's security team rates it Critical, 19 out of 25 on its own risk scale, and sites running Drupal 10 or 11 should already be on the fixed releases.
The fix shipped on October 14, 2026, in Drupal security advisory SA-CORE-2026-014, tracked as CVE-2026-108097. Peru's National Digital Security Center (CNSD) flagged the release again in its integrated alert N° 204-2026 on October 19, noting that Drupal had warned administrators in advance on October 12 to set time aside for the update.
Core alone is safe, but few sites run core alone
Drupal's advisory is careful about where the danger lies. The vulnerability is not directly exploitable on a site running only Drupal core. However, the advisory says "multiple serious exploit paths exist with contributed modules", at least one of which requires no authentication, and that custom code may also expose the vulnerable functionality. Because almost every production Drupal site runs contributed modules, the safe assumption is that a typical site is exposed until it is patched.
Drupal has not published how the bug works beyond naming the Field UI module and the remote code execution outcome, and its risk string marks exploitation as theoretical at the time of release. Neither Drupal nor CNSD reports exploitation in the wild. The flaw was reported by Drew Webber of the Drupal Security Team and Octavio Galland.
Drupal Steward, the project's web application firewall service, already blocks some known attack routes, but the advisory warns that this protection does not cover every possible exploit, so Steward customers should still upgrade.
Two smaller XSS fixes rode along
The same October 14 release fixed two moderately critical cross-site scripting issues. SA-CORE-2026-015 (CVE-2026-108515, 13 out of 25) covers the core Link module, which did not properly sanitize some markup. SA-CORE-2026-016 (CVE-2026-108514, 12 out of 25) covers the Navigation module, and is limited by the fact that an attacker needs a role allowed to enter specific HTML attributes or to administer menus. CNSD's bulletin also reports a contributed Entity List module flaw with exploit paths that depend on other modules. IntelFusions could not confirm that advisory on Drupal's own feed, so readers should check the Drupal contributed-project advisories directly.
A week later, PHP itself patched the critical php2shell flaws, so many Drupal sites have two separate layers to update this month: the CMS and the PHP runtime underneath it.
Update to 11.4.10, 11.3.19 or 10.6.19, or remove Field UI
- Drupal 11.4.x: update to 11.4.10.
- Drupal 11.3.x: update to 11.3.19.
- Drupal 10.6.x: update to 10.6.19.
- Drupal 11.2.x and older, 10.5.x and older, and all Drupal 8 and 9 sites are end-of-life and get no fix.
If you cannot patch right away, Drupal says uninstalling the core Field UI module (field_ui) provides protection while you update. Field UI is an administrative tool for building content types, so many production sites can live without it between site-building sessions.
Drupal's advance warning, as relayed by CNSD, that exploits could follow within hours or days of disclosure is the reason this one matters even without confirmed attacks. When a critical flaw depends on which modules a site happens to run, the only reliable way to know you are safe is to stop relying on the module list and simply apply the update.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.