Drupal Patches Critical Unauthenticated RCE Vulnerability in Field UI Module

The Drupal security team has issued patches addressing a critical remote code execution vulnerability in the Field UI module. The flaw, identified as CVE-2026-108097, can be triggered under specific combinations of components and allows attackers to execute arbitrary code on affected sites.

While the vulnerability does not affect the Drupal core in isolation, at least one documented attack scenario requires no authentication whatsoever. In such cases, an attacker does not need an administrator password to compromise the system. Exploitation conditions and available fixes are detailed in the official Drupal security bulletin.

The dangerous attack paths emerge primarily when the module is used alongside third-party extensions. Custom site code can also inadvertently expose the vulnerable functionality to remote attackers. The patches are available in Drupal 11.4.10, Drupal 11.3.19, and Drupal 10.6.19.

As a temporary mitigation, developers recommend removing the Field UI module until updates can be applied. The Drupal Steward service blocks some known attack variants but does not address all possible exploitation methods.

Separately, another remote code execution vulnerability tracked as CVE-2026-108099 has been resolved in the Entity List contributed module. The fix requires version 3.0.10, and unauthenticated attack scenarios are also known when combined with other modules.

Before the patches were released, the Drupal team warned that working exploits could appear within hours or days. No reports of ongoing attacks have been included in the security bulletins.