Affected Systems

Drupal core versions 10.6.x, 11.3.x, and 11.4.x with Field UI module enabled. Fixed in 10.6.19, 11.3.19, and 11.4.10. Drupal 8, 9, and older 10.x/11.x branches are end-of-life and unpatched. Exploitation requires contributed modules or custom code; at least one unauthenticated path exists via unnamed contributed modules. Entity List module (CVE-2026-108099) also affected separately.

Exploitation Status

No public exploits or active attacks reported as of October 15, 2026. Drupal Security Team warned exploits may emerge within hours or days. No PoC code published yet. Drupal Steward WAF blocks some known vectors but not all paths.

Business Impact

Critical RCE vulnerability (CVE-2026-108097, Drupal risk score 19/25) allows arbitrary code execution on server via Field UI module when combined with certain contributed modules or custom code. Core alone is not exploitable. Unauthenticated attack path confirmed. Approximately 28.5% of reporting Drupal sites (151,442 of 531,499) run unpatched end-of-life versions. Immediate patching required for production sites. Temporary mitigation available by uninstalling Field UI module, which disables field management UI.

Urgency

🔴 Immediate

Recommended Actions

  • Update Drupal core immediately: 10.6.x to 10.6.19, 11.3.x to 11.3.19, 11.4.x to 11.4.10. Drupal 7 users on Pantheon LTS should update to 7.107.
  • Update Entity List module to 3.0.10 if installed (CVE-2026-108099 shares same vulnerability pattern).
  • If immediate patching is not possible, uninstall the field_ui module as temporary mitigation. Note this disables field and display management admin pages.
  • Test manage fields and manage display pages after update, especially if custom code sets #region_callback on field_ui_table rows (this callback no longer executes post-patch).
  • Review and inventory all contributed modules and custom code that interact with Field UI; monitor Drupal security advisories for disclosure of specific vulnerable modules.
  • Plan migration off Drupal 11.3.x and 10.6.x before December 2026 end-of-security-support deadline.