Critical Drupal Field UI RCE Vulnerability Summary

Drupal has disclosed a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-108097 (Drupal SA-CORE-2026-014), affecting the Field UI module in Drupal core. The flaw received a risk score of 19/25, indicating high severity due to its potential to allow full website takeover, including the exposure of private data and unauthorized modification or deletion of information.

While Drupal core does not provide a direct exploitation path, the Drupal Security Team has confirmed that several serious attack paths exist when certain contributed modules are installed or when custom code exposes vulnerable functionality. Crucially, some of these paths allow for unauthenticated exploitation, meaning an attacker does not need prior access to the system.

The vulnerability impacts a wide range of versions including Drupal 8, 9, 10, and 11. Given the risk of unauthenticated RCE and the broad install base of Drupal, organizations should prioritize patching to the latest stable versions (10.6.19, 11.3.19, or 11.4.10) immediately.