The Drupal Security Team published SA-CORE-2026-014 on 14 October 2026 for CVE-2026-108097, a remote code execution flaw in the core Field UI module (the admin UI for managing fields and their display). Drupal rates it Critical 19/25 (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default).

The advisory says the issue is not directly exploitable with core alone, but multiple serious exploit paths exist through contributed modules, and at least one known path needs no authentication; custom code may also expose the vulnerable functionality. Mitigate immediately by uninstalling the core field_ui module while preparing the upgrade. Fixed releases: Drupal 11.4.10, 11.3.19, 10.6.19, and 12.0.0-beta2 for the 12.0 beta line (beta branch only).

Drupal 11.2.x and below, 10.5.x and below, and Drupal 8/9 are end-of-life and receive no fix. Drupal Steward is described as protecting some known attack vectors but not all.

Reported by Drew Webber of the Security Team and Octavio Galland. Primary: Drupal SA-CORE-2026-014.

UPDATE 14–17 Oct 2026: In the same 14 October security window the Drupal Security Team also published SA-CONTRIB-2026-218 for the contributed Entity List module (entity_list, which builds lists of entities without Views): CVE-2026-108099, remote code execution, rated Critical 19/25 with the same risk vector. As with the core flaw, the module alone is not directly exploitable, but multiple serious exploit paths exist through other contributed modules, at least one known path needs no authentication, and custom code may also expose it.

The fix is Entity List 3.0.10. BleepingComputer (17 October) reported both flaws together and noted the Security Team's pre-release warning that exploits might be developed within hours or days of disclosure.

No exploitation has been reported so far.