The **Drupal Security Team** has released urgent patches to address a critical remote code execution (RCE) vulnerability in the core Field UI module. This flaw, identified as **CVE-2026-108097**, could allow an attacker to execute arbitrary code on a site's server. Patches were shipped on October 14 across **Drupal** versions 11.4.10, 11.3.19, and 10.6.19. The **Drupal Security Team**'s advisory clarifies that the flaw isn't directly reachable through core alone but can be exploited via various contributed modules, with at least one known path requiring no login.  **CVE-2026-108097** resides within the Field UI, the core module responsible for the administrative pages where site builders manage fields and their display. **Drupal** has rated this vulnerability 19 out of 25 on its internal risk scale, classifying it as critical. The advisory credits Drew Webber of the **Security Team** and Octavio Galland for reporting the flaw. ### Immediate Action Required Site administrators should prioritize updating their **Drupal** installations to the following patched versions: * **Drupal** 11.4.x: Update to [11.4.10](https://www.drupal.org/project/drupal/releases/11.4.10) * **Drupal** 11.3.x: Update to [11.3.19](https://www.drupal.org/project/drupal/releases/11.3.19) * **Drupal** 10.6.x: Update to [10.6.19](https://www.drupal.org/project/drupal/releases/10.6.19) * **Drupal** 12.0.0 beta: [12.0.0-beta2](https://www.drupal.org/project/drupal/releases/12.0.0-beta2) (not for production use) Older, end-of-life versions, including **Drupal** 11.2.x and below, 10.5.x and below, and **Drupal** 8 and 9, will not receive fixes. It's also important to note that **Drupal** 11.3.x and 10.6.x will lose security coverage in December 2026. As of the week starting October 4, statistics from **drupal.org** indicated that approximately 28.5% (151,442 out of 531,499 reporting sites) were on an affected branch that did not receive a fix. For sites unable to update immediately, uninstalling the Field UI module (`field_ui`) offers temporary protection, though this will disable the administrative pages for managing fields and their display. The Field UI module is typically installed by default with **Drupal**'s Standard install profile. **Drupal Steward**, a web application firewall service, already incorporates rules to block some known attack vectors for this vulnerability. Providers like **Acquia**, **Pantheon**, **Ironstar**, and **Skpr** offer this service to their customers. However, the advisory stresses that **Drupal Steward** does not cover every potential exploit, and sites should still proceed with updates. At the time of the advisory's publication, no public exploit code was known, and as of October 15, no active attacks had been reported. The **Security Team** had pre-announced the release on October 12, urging sites to prepare for immediate updates due to the potential for rapid exploit development. This follows a similar incident in May where **Drupal** observed exploit attempts within two days of an advisory for a core SQL injection flaw affecting **PostgreSQL** sites, which **CISA** subsequently added to its catalog of exploited vulnerabilities. ### Technical Details of the Fix The vulnerability stemmed from how Field UI constructed its administrative tables. Before the fix, the table element's pre-render step would execute any PHP callable defined in a table row's `#region_callback` property via `call_user_func_array`, without proper validation of the callable. While **Drupal**'s renderer has generally restricted untrusted render callbacks since version 8.8 in 2019, the check did not apply to callables executed within the table element's trusted pre-render step. The [patched code in 11.4.10](https://raw.githubusercontent.com/drupal/drupal/11.4.10/core/modules/field_ui/src/Element/FieldUiTable.php) eliminates the direct call to `#region_callback`. Instead, it now reads the region from the row's `region` value, falling back to the table's hidden or first region if undefined. This behavior had been present in the code since at least **Drupal** 8.9.0 in 2020. Custom code that previously set `#region_callback` on a `field_ui_table` row will find that it no longer executes after the update. **Pantheon** advises sites to review such custom code and thoroughly test manage fields and manage display pages post-update. ### Related Vulnerabilities In addition to **CVE-2026-108097**, the **Entity List module** also received its own critical RCE advisory, **CVE-2026-108099**, under similar conditions, including an unauthenticated exploit path. Its [3.0.10 release note](https://www.drupal.org/project/entity_list/releases/3.0.10) confirms the fix mirrors the Field UI change, emphasizing that updating core does not update this contributed module. Approximately 90 sites reported using the **Entity List module** in the week of October 4. The same core releases also address two moderately critical cross-site scripting (XSS) flaws: **CVE-2026-108515** in the **Link module** and **CVE-2026-108514** in the **Navigation module**. Both require at least a logged-in user for exploitation. For **Drupal 7**, which reached end-of-life on **drupal.org** in January 2025, **Pantheon**'s long-term support, in collaboration with **Tag1 Consulting**, has released **Drupal** 7.107, which includes a backport of the fix.