Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication

What happened?

Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026. The official security advisory, SA-CORE-2026-014, assigns the issue a risk score of 19 out of 25 under Drupal’s rating system. Successful exploitation could expose all private website data and allow attackers to change or delete information. The score is not a CVSS rating.

Key details

• Exploitation requires contributed modules or custom code beyond Drupal core alone.
• Affected versions span Drupal 8.9.0 to 10.6.x, 11.0.0 to 11.3.x, and 11.4.0 to 11.4.x before fixes.
• Security updates released as Drupal 10.6.19, 11.3.19, and 11.4.10.
• Uninstalling Field UI module provides temporary protection while updating.
• Drupal Steward blocks some attack paths but is not a permanent fix.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.