Drupal Patches a Critical Flaw That Could Let Attackers Run Code on a Site
The Drupal security team shipped a fix on Oct. 14, 2026, for a flaw in Field UI, a module built into Drupal core, that could let an attacker run their own code on a site's server. The team rates the flaw Critical, 19 of 25, on its own risk calculator.
The advisory tells site owners to install the latest release for their branch, and says uninstalling the core Field UI module will protect a site in the meantime, while it is being updated. It also says the flaw is not directly exploitable with core alone, that multiple serious exploit paths exist with contributed modules, and that at least one known path requires no login.
The advisory, SA-CORE-2026-014, carries the identifier CVE-2026-108097. Sites on the 11.4 branch should update to Drupal 11.4.10, sites on 11.3 to Drupal 11.3.19, and sites on 10.6 to Drupal 10.6.19.
Four more advisories went out in the same release. Two cover moderately critical cross-site scripting flaws in core, in the Link and Navigation modules, where a page can carry markup the site should have stripped. Two cover contributed projects, including a remote code execution flaw in the Entity List module that the team also rated Critical. Two days before the release, the team published a notice telling site owners to reserve time for the update because exploits might be developed within hours or days.
The advisory lists Drupal 11.2.x and below and Drupal 10.5.x and below as end-of-life, with no security coverage, and says Drupal 8 and 9 have reached end-of-life too. Sites on those branches get no fix.
