Critical Drupal Core Vulnerability Exposes Sites to Remote Code Execution via Field UI Module

Drupal has issued urgent security updates to address a critical remote code execution vulnerability residing within its core Field UI module. Tracked under the identifier CVE-2026-108097, the flaw poses a severe risk to website administrators and developers worldwide, as it potentially allows malicious actors to execute arbitrary code directly on a target site’s underlying server infrastructure. The Drupal Security Team formally released patches on October 14, 2026, delivering fixes across multiple active branches in versions 11.4.10, 11.3.19, and 10.6.19.

According to the official advisory published by the Drupal Security Team, the vulnerability cannot be exploited through Drupal core in isolation. However, several hazardous exploit paths exist when combined with specific contributed modules or custom code. Most alarming is the discovery that at least one known attack vector requires no user authentication whatsoever, enabling unauthenticated remote attackers to target vulnerable installations directly over the internet.

The security flaw originates in the Field UI component, which serves as the core module powering the administrative dashboard pages where site builders manage content fields and configure their display settings. Drupal evaluates the severity of this vulnerability as 19 out of 25 on its proprietary risk scale, categorizing the issue as critical. The vulnerability was discovered and reported to the project by security researchers Drew Webber, a member of the Drupal Security Team, alongside researcher Octavio Galland. While the advisory itself refrains from publicly naming the specific contributed modules that expose this exploit path, security analysts emphasize that custom-built code implementing similar administrative interfaces may also leave sites exposed.

What to Do Now

With the release of Drupal versions 11.4.10, 11.3.19, and 10.6.19, administrators are strongly advised to apply the security updates immediately. Maintaining vigilance is particularly crucial given that both the 11.3.x and 10.6.x maintenance branches are scheduled to lose official security coverage in December 2026.

Statistics released by the Drupal project underscore the urgency of the situation. During the week commencing October 4, 2026, usage data indicated that 151,442 out of 531,499 sites—representing approximately 28.5% of all installations reporting their core version to drupal.org—were operating on an affected branch that did not receive a direct patch in this advisory cycle.

For web administrators who cannot immediately apply the core updates, the Drupal Security Team has outlined an effective interim mitigation strategy. Sites can temporarily uninstall the Field UI module, known in the system as field_ui. According to the advisory, disabling this module provides vital protection while organizations schedule and execute their core updates. Naturally, once uninstalled, the administrative pages dedicated to managing fields and display configurations will be temporarily unavailable. Because the Field UI module is bundled by default within Drupal’s Standard installation profile, any site originally built using that profile possesses the module unless it was explicitly removed by an administrator.

Additionally, automated defenses have already been deployed across major hosting platforms. Drupal Steward, a specialized web application firewall service featuring rules crafted directly by the Drupal Security Team, has been configured to actively block several known attack vectors associated with this vulnerability. Managed hosting providers including Acquia, Pantheon, Ironstar, and Skpr have deployed Drupal Steward to protect their client base. Nevertheless, the advisory stresses that the firewall service does not guarantee complete coverage against every conceivable exploit variation, meaning affected sites must still prioritize applying the official software updates.

As of October 15, the Drupal Security Team confirmed that no publicly available exploit code had surfaced, and neither the official advisory nor external reports had documented active attacks in the wild exploiting CVE-2026-108097. However, the project had issued a pre-announcement on October 12, explicitly urging site administrators to reserve time for the upcoming patch rollout because functional exploits could easily be developed within hours or days of the disclosure.

This proactive caution is well-founded. Back in May, Drupal issued an advisory regarding a core SQL injection vulnerability that selectively impacted sites operating on PostgreSQL. Attack attempts against that flaw materialized within a mere two days of disclosure, prompting the Cybersecurity and Infrastructure Security Agency to subsequently add the vulnerability to its catalog of actively exploited security flaws.

What the Fix Changed

To understand the mechanics of the vulnerability, security analysts have examined how the Field UI module constructs its administrative tables. The module builds these interface tables using render arrays—standard PHP arrays that Drupal subsequently transforms into HyperText Markup Language.

Prior to the implementation of the security patch, the pre-render phase of the table element would indiscriminately execute whichever PHP callable was designated within a table row’s #region_callback property. This execution relied on the PHP function call_user_func_array without conducting any validation checks to determine whether the specified callable was trusted or safe.

Drupal’s rendering engine has theoretically refused to process untrusted render callbacks since the release of version 8.8 in late 2019. That foundational restriction was introduced following earlier security advisories that demonstrated how easily the rendering system could be manipulated into calling arbitrary functions. However, because the renderer inherently trusted the table element’s internal methods, it permitted the pre-render step to execute, meaning the security check was bypassed entirely before it could intercept the malicious callable.

The updated codebase in version 11.4.10 eliminates this vulnerability by completely removing the execution of the callback. Instead, the updated code reads each row’s region value directly from the row itself, falling back safely to the table’s hidden region or its default first region if the provided value does not match a recognized layout region. Historical code analysis indicates that this vulnerable callback mechanism had persisted within the core codebase since at least the release of Drupal 8.9.0 in 2020.

While the core modification secures the framework, developers should note potential side effects. Within core itself, the callback was exclusively utilized by Field UI’s native display forms. However, custom modules or bespoke site code that explicitly set the #region_callback property on a field_ui_table row will find that this code ceases to function following the update. Hosting providers like Pantheon have advised development teams to thoroughly audit custom codebase implementations and test their manage fields and display pages immediately after applying the update.

Beyond the primary core flaw, the security update landscape encompasses related module advisories. The Entity List contributed module received its own critical remote code execution advisory, tracked as CVE-2026-108099, which shares identical conditions including an unauthenticated attack path. The maintainers released version 3.0.10, noting that the fix mirrors the adjustments made to Field UI. Because updating Drupal core does not automatically update contributed modules, administrators running Entity List—numbering around 90 reporting sites during the first week of October—must update the module independently.

Furthermore, the same core maintenance releases patch two moderately critical cross-site scripting vulnerabilities. These affect the Link module, tracked as CVE-2026-108515, and the Navigation module, tracked as CVE-2026-108514. Both cross-site scripting flaws require an attacker to have at least a standard user account with login privileges to initiate an attack.

Although Drupal 7 officially reached its end of life on drupal.org in January 2025, long-term support operations continue through specialized channels. Pantheon confirmed that its Drupal 7 long-term support program, maintained in partnership with Tag1 Consulting, has successfully published version 7.107 to incorporate a secure backport of the core fix.