CVE-2026-108099

Drupal Patches Critical Unauthenticated RCE Vulnerability in Field UI Module

The Drupal team has released patches for a critical vulnerability in the Field UI module that can enable remote code execution under specific component combinations. Although the core CMS alone is insufficient for exploitation, at least one known attack path requires no authentication, eliminating the need for an administrator password. The flaw, tracked as CVE-2026-108097, arises when combined with third-party modules or custom site code that exposes vulnerable functionality. Fixes are included in Drupal versions 11.4.10, 11.3.19, and 10.6.19, with temporary mitigation achieved by removing the Field UI module. Drupal Steward provides partial protection against known variants but does not cover all possibilities. A separate RCE issue, CVE-2026-108099, was also fixed in the Entity List module version 3.0.10, which similarly allows unauthenticated exploitation in certain configurations. Prior to the patches, developers warned that exploits could appear within hours or days, though no active attacks have been reported.