Drupal released security advisory SA-CORE-2026-014 on October 14, 2026, fixing CVE-2026-108097, a critical remote-code-execution vulnerability in the core Field UI module. Drupal rates it 19/25. Core alone is not directly exploitable, but contributed modules and custom code can expose serious attack paths; at least one known path requires no login. Administrators should update to the fixed branch immediately, or uninstall Field UI until the update is complete.
What CVE-2026-108097 affects
The vulnerable component is Drupal’s core field_ui module, which supplies administration screens for creating fields and managing how they are displayed. The flaw is in Field UI table rendering. Before the fix, a table row’s #region_callback value could be executed as a PHP callable without validating that callback. An attacker who reaches a vulnerable table-building path could therefore achieve remote code execution.
As an Amazon Associate I earn from qualifying purchases.
Drupal’s advisory says the defect is not directly exploitable with core alone. That qualification does not make an exposed site safe: multiple contributed modules can create reachable paths, and custom code may expose the same functionality. At least one known exploit path does not require authentication, so an attacker may not need a Drupal account.
Which Drupal versions are vulnerable
| Affected range | Fixed release | Important qualification |
|---|---|---|
| Drupal 8.9.0 through 10.6.x below 10.6.19 | 10.6.19 | Drupal 8 and 9, plus Drupal 10.5.x and earlier, are end of life and do not receive security coverage. |
| Drupal 11.0.0 through 11.3.x below 11.3.19 | 11.3.19 | Drupal 11.2.x and earlier are end of life; only supported branches should be treated as receiving a security fix. |
| Drupal 11.4.0 through 11.4.x below 11.4.10 | 11.4.10 | Upgrade within the 11.4 branch to this release. |
| Drupal 12.0.0-alpha1 through versions below 12.0.0-beta2 | 12.0.0-beta2 | The secondary report notes that this beta is not intended for production use. |
Sites should verify the running core version rather than relying on the major-version label. A site on an end-of-life branch cannot obtain ongoing security coverage simply by applying this one patch; it needs a supported-branch migration.
#1 Best Overall
Immediate response for site administrators
- Identify the branch and update core. Move Drupal 11.4.x sites to 11.4.10, Drupal 11.3.x sites to 11.3.19, and Drupal 10.6.x sites to 10.6.19. For a Drupal 12.0.0-alpha1 installation, move to 12.0.0-beta2 only with the understanding that the beta is not a production release. Plan a supported-version migration for any end-of-life installation.
- Use the documented temporary mitigation if the update cannot finish now. Uninstall the core Field UI module,
field_ui. Drupal says this provides protection while the site is being updated. Uninstallation removes the administration pages used to manage fields and their display, so editors and administrators will lose those functions until Field UI is restored. - Inventory contributed modules separately. Core updates do not update contributed projects. Review every installed module’s security advisories, with particular attention to modules that build Field UI tables or expose field-management routes.
- Inspect custom code. Search for code that constructs Field UI tables or sets
#region_callback. Test those paths after the core update, because behavior changes in the fix may require a code adjustment. - Check for compromise. Because at least one path is unauthenticated, review web-server and Drupal logs for unusual requests, newly created accounts, unexpected PHP files, altered module code, or other signs of post-exploitation. Preserve logs before cleanup if an incident is suspected.
Why contributed modules create the no-login risk
Field UI’s vulnerable code is reached through table-rendering behavior supplied or reused by other components. Drupal has not publicly named every contributed module that opens an exploit path. That means a clean core-only test is not enough: the actual exposure depends on the modules and custom code installed on each site.
The Hacker News reported a separate critical advisory for the contributed Entity List module, CVE-2026-108099, with similar conditions and a known no-login path. Updating Drupal core does not update Entity List or any other contributed project. Administrators must apply each project’s own security release or remove the project if it cannot be secured.
What the patch changes internally
The fixed implementation no longer calls a row-provided #region_callback as a PHP callable. Instead, it takes the region from the row’s data and falls back to the table’s hidden region or its first region when necessary. This removes the unsafe callback execution path.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →That change can affect custom integrations that depended on callbacks to place rows in Field UI tables. Such code is not evidence of compromise by itself, but it should be reviewed and tested in a staging environment before and after deployment. Confirm that field-management screens render correctly and that any custom row grouping still behaves as intended.
How much exposure is visible in the wild
The Hacker News reported that 151,442 of 531,499 reporting Drupal sites—28.5 percent—were on an affected branch that had received no fix during the week beginning October 4, 2026. The same report counted 90 sites using Entity List. These figures are a snapshot of reporting sites, not a census of every Drupal installation, and they do not establish how many sites were exploited.
Does Drupal Steward replace patching?
No. Drupal states that Drupal Steward blocks some known attack vectors, but its protection does not cover all possible exploits. The Hacker News identified Acquia, Pantheon, Ironstar, and Skpr as providers running Drupal Steward for customers. Such managed protection or hosting can reduce exposure while administrators work, but it is only a partial control. The core update, contributed-module updates, custom-code review, and end-of-life migration remain necessary.
Rank #4
Operational decision guide
| Response option | Time to protection | Coverage | Operational effect |
|---|---|---|---|
| Upgrade core to the fixed release | After the update and verification complete | Removes the core defect; contributed modules and custom code still require separate review | Requires testing, deployment planning, and possible callback adjustments |
Uninstall field_ui temporarily |
Immediate once uninstallation succeeds | Mitigates this Field UI vulnerability while it is absent | Field and display administration pages are unavailable |
| Rely on Drupal Steward protection | Depends on the provider’s controls | Some known vectors only; not every possible exploit | Must be treated as an interim layer, not a substitute for patching |
The safest sequence is to limit exposure immediately, update core and every affected contributed project, then validate custom Field UI integrations and restore normal administration only after testing.
Quick Recap
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
