Severe Drupal Vulnerability Puts Websites At Risk

Drupal has released security updates for a critical vulnerability that could allow attackers to execute commands on affected websites without logging in.

The flaw, tracked as CVE-2026-108097, affects the Field UI module in Drupal core. The Drupal Security Team published the advisory on October 14, 2026.

According to the official Drupal security advisory, the issue received a risk score of 19 out of 25 under Drupal’s own rating system. It is not a CVSS score.

If exploited, the vulnerability could allow attackers to access private website data, modify content, or delete information.

How the Drupal Vulnerability Works

The vulnerability affects Drupal’s Field UI module, which helps administrators manage fields on their websites.

Drupal core alone does not provide a direct way to exploit this issue. However, the security team has confirmed that certain contributed modules and custom website code can create attack paths.

The main concerns include:

No login required: At least one known attack path can be used without an account.
Private data exposure: Attackers could potentially access sensitive website information.
Website changes: Successful exploitation could allow data to be modified or deleted.
Extensions and custom code: Additional modules or custom development may increase exposure.

The advisory does not identify all the modules involved or provide a public working exploit. Although exploitation is described as theoretical, website administrators should still take the warning seriously.

Which Drupal Versions Are Affected?

The vulnerability affects several Drupal versions, including:

Drupal 10.6 versions earlier than 10.6.19.
Drupal 11.3 versions earlier than 11.3.19.
Drupal 11.4 versions earlier than 11.4.10.
Drupal 12 development releases from 12.0.0-alpha1 up to, but not including, 12.0.0-beta2.

Older Drupal branches, including Drupal 8, Drupal 9, Drupal 10.5 and earlier, and Drupal 11.2 and earlier, are no longer covered by security support.

Administrators should check all their Drupal installations and identify any unsupported versions that may need a migration plan.

How to Protect Your Drupal Website

Website administrators should apply the appropriate security update as soon as possible.

Recommended actions include:

Update Drupal: Install Drupal 10.6.19, 11.3.19, or 11.4.10, as appropriate for your supported branch.
Temporarily disable Field UI: If an immediate update is not possible, uninstall the core field_ui module as advised by Drupal.
Review contributed modules: Check installed extensions and custom code for potentially exposed functionality.
Review website activity: Investigate suspicious changes, unexpected access, or unfamiliar scripts.
Do not rely only on filtering: Drupal Steward can block some known attack paths, but it does not cover every possible exploitation method.

Organizations should prioritize patching and verify that every deployed Drupal website is protected. For additional investigation guidance, see our article on detecting and investigating webshells.

The bottom line: Updating Drupal to a fixed version is the recommended long-term solution. If an update must be delayed, disabling Field UI can provide a temporary mitigation while the upgrade is prepared.