Drupal Field UI RCE: Patch CVE-2026-108097 Now (2026)

On October 14, 2026, the Drupal Security Team published SA-CORE-2026-014: a critical 19/25 remote code execution flaw in the Field UI core module, tracked as CVE-2026-108097. If you run a Drupal site, this is one of those advisories you act on the same day.

This one is unusual. The Drupal Field UI RCE is not exploitable with core alone — but multiple serious exploit paths exist through contributed modules, and at least one known path needs no authentication. Patching core is necessary, but for some sites it is not the whole story: the same day brought a twin critical flaw in the contributed Entity List module plus three more advisories you may need to act on.

This guide gives you the decision tree: check whether you are affected, patch core the safe way, handle the side updates, and what to do if you cannot update today. Every fact is verified against the official advisories as of 2026-10-18 — the date stamp matters, because as of this morning there is no public exploit code and no CISA KEV listing, and Drupal itself warned that exploits could appear within hours or days.

Table of Contents

What CVE-2026-108097 is — the 30-second version

Flaw	CVE-2026-108097
Advisory	SA-CORE-2026-014, published October 14, 2026 (reported by Drew Webber and Octavio Galland)
Severity	Critical, 19/25 on the Drupal risk scale
Component	Field UI core module
Attack	Remote code execution; at least one known path needs no authentication
Fixed in	Drupal 11.4.10, 11.3.19, 10.6.19, 12.0.0-beta2
Exploit code	None public as of 2026-10-18; not in the CISA KEV catalog

A word on that 19/25. It is Drupal’s own risk matrix: this is the second-highest rating the scale gives. The advisory’s vector (AC:Basic/A:None) tells you authentication is not required on the known path, while E:Theoretical means exploitation was rated theoretical at publication time. That last part is reassuring only until you remember Drupal’s own pre-announcement warning: exploits might be developed within hours or days. The clock is the thing to watch here.

How the Drupal Field UI RCE actually works

Field UI builds the admin tables you use to manage fields on content types. During pre-render, a table element executed whatever PHP callable a table row carried in its #region_callback property — via call_user_func_array, with no validation of the callback at all. Read that again: whoever controls the table rows controls the code that runs.

Here is why core alone is safe-ish. No code path in core builds one of these tables from input an outsider can influence, so the flaw sits dormant in a default install. The moment a contributed module — or your own custom code — builds a Field UI table in a way an attacker can influence, the path opens. The advisory says it plainly: “custom code may also expose the vulnerable functionality.” Your custom modules count as attack surface here, not just contrib.

The fix is surgical, which is good news for your upgrade: Drupal now reads the row’s region value instead of invoking the callback. One line of trust removed, one whole class of attack gone. This is why the core patch is low-risk — it changes a rendering detail, not your data model.

Step 1 — check whether the Drupal Field UI RCE affects you

Work through this in order. It takes five minutes and decides everything else.

Find your exact core version. Run drush status --fields=drupal-version, or composer show drupal/core, or open Administration → Reports → Status report. Write down the full number — “11.4” is not enough; you need “11.4.8” or whatever it actually is.
Match it against the affected ranges. You are affected if your version falls in: 8.9.0 up to (not including) 10.6.19; 11.0.0 up to (not including) 11.3.19; 11.4.0 up to (not including) 11.4.10; or 12.0.0-alpha1 up to (not including) 12.0.0-beta2. In plain terms: 11.4.8 means patch to 11.4.10; 11.3.15 means 11.3.19; 10.6.17 means 10.6.19.
Check the dead end first. If you are on Drupal 11.2.x or below, 10.5.x or below, or still on 8 or 9, there is no security release for you at all — those branches are end-of-life and get no coverage. The advisory is blunt about it: upgrade your branch, then patch. And plan ahead while you are at it — The Hacker News notes that 11.3.x and 10.6.x lose security coverage in December 2026, so if you are on 11.3, schedule the jump to 11.4 now rather than in January.
Check your contributed modules. Entity List at 3.0.9 or below and the Gin admin theme on unfixed releases are the known side doors — details in Step 3. Also grep your custom code for the mechanism: grep -rn "region_callback" web/modules/custom web/themes/custom (adjust the path for older non-composer installs). Any hit near a Field UI table is worth a look from a developer.
Grasp the scale. In the week starting October 4, 151,442 of the 531,499 sites reporting their version to drupal.org — 28.5% — were on an affected branch with no fix (original reporting by The Hacker News). A lot of them are still there. If you are one of them, you are in crowded, visible company, and attackers know it.

Step 2 — patch core the safe way

The rule: stay on your branch, back up first, and let Composer do the work. Patching 11.4.8 to 11.4.10 is a minor security update — do not turn it into a branch upgrade in the same sitting unless you planned one.

# 1. Back up first — database and files
drush sql:dump --result-file=../backups/pre-SA-CORE-2026-014.sql

# 2. Update core (stays on your branch)
composer update "drupal/core-*" --with-all-dependencies

# 3. Run database updates, rebuild caches
drush updatedb
drush cache:rebuild

# 4. Confirm the new version
drush status --fields=drupal-version

If you keep a staging clone, patch there first and smoke-test the field management screens (Structure → Content types → Manage fields) before shipping to production.
The same core release also fixes two moderately-critical XSS flaws — the Link module (SA-CORE-2026-015, 13/25) and the Navigation module (SA-CORE-2026-016, 12/25). They ride along with this update; no separate action needed, but they are two more reasons not to sit on it.
After the update, composer show drupal/core and the Status report should agree on 11.4.10, 11.3.19, or 10.6.19. If they do not, something in your Composer setup pinned the version — investigate before you walk away.

Step 3 — the side updates the core patch does not cover

This is the part people miss. Updating Drupal core does not touch contributed modules, and two of them need action of their own.

Entity List — update to 3.0.10. SA-CONTRIB-2026-218 is a twin of the Field UI flaw inside the contributed Entity List module: critical 19/25, CVE-2026-108099, with the same unauthenticated-path conditions. The advisory is explicit that updating core does not replace the module’s vulnerable code, so this needs its own update: composer update drupal/entity_list, then drush updatedb, and confirm with composer show drupal/entity_list. Only about 90 sites reported using Entity List in the week starting October 4 — check whether you are one of them before worrying, but do check.
Gin admin theme — update to 4.1.4 or 5.0.16. SA-CONTRIB-2026-219 is a moderately-critical (13/25) XSS in the Gin admin theme, CVE-2026-110738. If Gin is your admin theme, update it like any other contrib package: composer update drupal/gin and verify the version lands on a fixed release.

Cannot patch today? Do this now

Sometimes the patch has to wait — a frozen deploy window, a host you cannot reach, a site you inherited with no backups. Two stopgaps, in order of usefulness:

Uninstall Field UI temporarily. drush pmu field_ui is the advisory’s own official mitigation: without the module installed, the vulnerable code is not there to reach. You lose the field-management admin screens until you reinstall it after patching — this is temporary and reversible, and it is the single most effective thing you can do today if the update must wait.
Do not lean on Drupal Steward alone. Steward blocks some known attack vectors but explicitly will not cover all possible exploits for this flaw. Treat it as a seatbelt, not a fix.

Non-negotiable either way: take a backup now so you have a pre-incident restore point, and keep watching the advisories. The “no public exploit” status can flip any hour — Drupal warned of exactly that.

After patching — verify and check for signs of trouble

Confirm the fixed version in two places: drush status --fields=drupal-version and the Status report.
Make sure database updates completed: drush updatedb should report no pending updates.
Look for intrusion signs: scan the watchdog log (drush watchdog:show --severity=Warning), check for unfamiliar admin-role accounts on the People page, and look for modules or themes you did not install. Unusual file modification times under web/modules are worth a second look too.
If you find signs of compromise, treat it as a full compromise: restore from your pre-patch backup, rotate every credential and API key the site touches, and re-patch before going live. The same log-first triage discipline applies — I use the same approach for WordPress incidents like the Premium Packages XSS from earlier this week.

The bigger lesson

This advisory is a pattern worth learning. The flaw was dormant in core — unreachable, unexploitable — until the ecosystem around it provided the path. Your contrib module count is part of your attack surface, and your custom code is too. “Core alone is safe” was true on October 13 and stopped being the whole story on October 14.

The second lesson is cadence. Drupal retires branches fast: 11.2 is already dead, 10.6 and 11.3 die in December. Five advisories landed in a single day, and one Composer command covered three of them. The sites still exposed are not the ones with hard problems — they are the ones that do not update. Do not be one of them.

Drupal Field UI RCE: Check and Patch CVE-2026-108097 Now (2026)