Drupal Fixes Critical Flaw That Could Let Attackers Run Code on Your Website's Server

Drupal has shipped fixes for a critical flaw in the Field UI module, the part of its core software behind the admin pages where site builders manage fields and how they display. Tracked as CVE-2026-108097, the flaw could let an attacker run code on the site's server. Fixes arrived on October 14 in Drupal 11.4.10, 11.3.19 and 10.6.19. Drupal rates the issue 19 out of 25 on its own risk scale, which it calls critical.

Core alone is not enough to reach the flaw. The Drupal Security Team says several exploit paths exist through contributed modules, and at least one known path needs no login. The advisory does not name those modules, and custom code may also expose the problem. The Field UI module is installed by Drupal's Standard install profile, so many sites will have it. In the week starting October 4, 151,442 of the 531,499 sites reporting their core version (28.5%) were on an affected branch that received no fix.

No public exploit code existed at publication, and as of October 15 no attacks had been reported. However, the Security Team warned that exploits might appear within hours or days. Sites that cannot update yet can uninstall the Field UI module, which the advisory says will provide protection, though the field management admin pages will be unavailable. Drupal Steward, a firewall service run by Acquia, Pantheon, Ironstar and Skpr, blocks some known attack paths, but sites should still update.