Skip to content

Drupal patches a critical RCE in its Field UI module

SA-CORE-2026-014 hits every supported branch, with at least one exploit path that needs no authentication. Update to 10.6.19, 11.3.19 or 11.4.10.

Source: Drupal.org

Drupal’s security team disclosed SA-CORE-2026-014 on 14 October, a critical remote code execution flaw in core’s Field UI module, tracked as CVE-2026-108097 with a risk score of 19 out of 25.

It affects every currently supported branch: 8.9.0 through 10.6.18, 11.0.0 through 11.3.18, and 11.4.0 through 11.4.9, plus the 12.0.0 beta. Fixes are in 10.6.19, 11.3.19 and 11.4.10. Core alone isn’t directly exploitable, but the advisory says multiple serious exploit paths exist once contributed modules are in the mix, and at least one of those needs no authentication at all. Uninstalling the field_ui module is the stopgap if you can’t update immediately.

composer require 'drupal/core:10.6.19' --update-with-dependencies

Why it matters: Drupal’s overall market share has shrunk to 0.7% of websites, but it still runs 7.5% of the top 1,000 highest-traffic sites, according to W3Techs, far more large organisations than its headline number suggests, and those are exactly the installs likely to be running the contributed modules this bug needs.

The caveat: Drupal hasn’t named which contributed modules open the unauthenticated path, so you can’t yet check your own exposure against a specific module list. Treat the update as urgent regardless.

Share

Related reading

Engineering

The N+1 you cannot see

Everyone knows to eager load. The queries that actually take sites down are the ones hiding in an accessor, a Blade partial, or a policy. There is a one-line switch that finds all of them.

Engineering

Queues are not optional

If your request handler calls somebody else’s API, you have already built a distributed system. The queue is how you stop their bad day from becoming your bad day.

Engineering

PHP got good and nobody told you

If your mental image of PHP is from 2014, it is wrong in ways that would change your architecture. Here is what actually landed, and which parts change how you write code.

More from The Wire

All briefs

GitHub Copilot retires six AI models today

Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 stop working across Copilot Chat, inline edits, agent mode and completions from today.

via GitHub