Drupal Warns Critical RCE Flaw Could Let Unauthenticated Attackers Compromise Websites

Drupal has warned of a critical remote code execution vulnerability that could let attackers compromise affected websites without logging in.

Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core and received a security risk score of 19 out of 25 in an advisory published on October 14, 2026.

The key detail is that Drupal core alone does not provide a direct route to exploit the flaw. However, contributed modules create several serious attack paths, and at least one known path requires no authentication.

Custom code can also expose the vulnerable function, making each website’s setup important when assessing risk. Researchers from Drupal identified a software vulnerability, not a malware campaign.

The advisory credits Drupal Security Team member Drew Webber and researcher Octavio Galland with reporting the issue. Drupal has not named a malware family, identified an attacker, or reported confirmed attacks in its official security advisory.

Drupal Warns Critical RCE Flaw

Remote code execution means an attacker can make a vulnerable system run code remotely. Here, the risk depends on whether installed modules or custom code expose the affected Field UI functionality.

The advisory does not name the contributed modules involved, publish a working exploit, or describe the exact requests needed to trigger the issue.

That distinction matters: running an affected Drupal version does not, by itself, prove that an anonymous visitor can exploit a site. Equally, administrators should not assume that a login requirement protects them.

Earlier coverage of critical Drupal security warnings showed why teams need to assess site configurations rather than rely only on broad severity labels.

Drupal lists the exploit status as theoretical in its risk assessment. That label should not be confused with a claim that the flaw is harmless: the same advisory describes multiple serious exploit paths and an unauthenticated route.

It provides no public evidence of active exploitation, so reports should keep possible impact separate from confirmed incidents. The risk score also marks attack complexity as basic and authentication as unnecessary, with full impact on confidentiality and integrity.

In plain terms, the advisory warns that a successful attack could expose or change site data. These ratings describe the potential severity of an exposed installation; they do not establish that every affected site has a publicly accessible attack path today.

Affected Versions and Security Updates

The affected ranges are Drupal versions from 8.9.0 to before 10.6.19, from 11.0.0 to before 11.3.19, and from 11.4.0 to before 11.4.10.

The advisory also lists Drupal 12 builds from 12.0.0-alpha1 to before 12.0.0-beta2, although its solution section gives upgrade instructions only for Drupal 10 and Drupal 11.

Administrators running Drupal 10.6.x should install 10.6.19. Those using Drupal 11.3.x should move to 11.3.19, while Drupal 11.4.x users should install 11.4.10. These are the fixed releases named in the advisory, not interchangeable update targets for every installation.

Drupal 10.5.x and earlier, Drupal 11.2.x and earlier, and Drupal 8 and 9 no longer receive security coverage under the advisory’s support guidance.

Earlier reporting on Drupal security update releases also illustrates why fixes must match the affected component and branch; an old update cannot address this newly disclosed vulnerability.

Drupal says uninstalling the core Field UI module, identified as field_ui, mitigates the vulnerability while sites are updated. Its wording specifically calls for uninstalling the module.

Administrators should not treat hiding its interface or limiting access to a menu as equivalent protection, because neither measure is the stated workaround.

Drupal Steward already protects subscribers against some known attack paths. However, Drupal warns that this protection does not cover every possible exploit. Sites using the service still need to upgrade because further attack paths could be discovered.

The possible consequences deserve attention without overstating the evidence. Past coverage of a Drupal website ransomware incident described suspected exploitation against Ukraine’s Energy Ministry website.

That separate case offers context for the stakes of website compromise, but it is not evidence that CVE-2026-108097 has delivered ransomware or been used against any named organization.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team