View online: https://www.drupal.org/sa-core-2026-014 Project: Drupal core [1] Project machine name: drupal Date: 2026-October-14 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated. .. Drupal Steward protection: This issue is being protected by Drupal Steward [3]. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.10 [4]. * If you use Drupal 11.3.x, update to Drupal 11.3.19 [5]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.19 [6]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [7] and Drupal 9 [8] have both reached end-of-life. Release packaging may still be in progress for this security announcement. If you are unable to access a release, wait 30-45 minutes and then check again. Reported By: * Drew Webber (mcdruid) [9] of the Drupal Security Team * Octavio Galland (ogalland-tob) [10] Fixed By: * catch (catch) [11] of the Drupal Security Team * Lee Rowlands (larowlan) [12] of the Drupal Security Team * Dave Long (longwave) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [16] of the Drupal Security Team * Bram Driesen (bramdriesen) [17] of the Drupal Security Team * catch (catch) [18] of the Drupal Security Team * Greg Knaddison (greggles) [19] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [20] * Lee Rowlands (larowlan) [21] of the Drupal Security Team * Dave Long (longwave) [22] of the Drupal Security Team * Drew Webber (mcdruid) [23] of the Drupal Security Team * Juraj Nemec (poker10) [24] of the Drupal Security Team * Pierre Rudloff (prudloff) [25] of the Drupal Security Team * Jess (xjm) [26] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [27] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/11.4.10 [5] https://www.drupal.org/project/drupal/releases/11.3.19 [6] https://www.drupal.org/project/drupal/releases/10.6.19 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/psa-2023-11-01 [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/ogalland-tob [11] https://www.drupal.org/u/catch [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/longwave [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/xjm [16] https://www.drupal.org/u/akalata [17] https://www.drupal.org/u/bramdriesen [18] https://www.drupal.org/u/catch [19] https://www.drupal.org/u/greggles [20] https://www.drupal.org/u/hestenet [21] https://www.drupal.org/u/larowlan [22] https://www.drupal.org/u/longwave [23] https://www.drupal.org/u/mcdruid [24] https://www.drupal.org/u/poker10 [25] https://www.drupal.org/u/prudloff [26] https://www.drupal.org/u/xjm [27] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....