Drupal 11.4.10 fixes a critical Field UI RCE flaw

Drupal's security team released fixes on October 14, 2026, for a critical flaw that can let an attacker run code on a Drupal site. The bug sits in Field UI, a module that ships with Drupal itself, and is tracked as SA-CORE-2026-014 and CVE-2026-108097. Core alone is not directly exploitable, but add-on modules open several paths in, and at least one of them needs no login.

The Drupal core advisory rates the flaw 19 out of 25 on Drupal's own risk scale, which puts it in the Critical band. Fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19.

What the Field UI flaw is

Drupal is an open-source content management system written in PHP. Field UI is the part of Drupal that gives site builders screens for adding fields, such as a date or an image, to a type of content.

The advisory calls the bug remote code execution, or RCE. That means an attacker could make the server run commands of their choosing. It is among the most serious kinds of web flaw, because it can hand over the whole site.

The catch is in how the bug is reached. "The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules," the advisory says. Contributed modules are the free add-ons that most Drupal sites install from drupal.org. The advisory adds that at least one known path does not require authentication, and that a site's own custom code may also expose the flaw.

How Drupal scores the risk

Drupal rates each flaw with a short code. The core advisory gives AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default. Here is what each part means.

Part	Value	Plain meaning
AC	Basic	The attack takes some steps, but nothing unusual
A	None	No login is needed on the scored path
CI	All	All non-public data could be read
II	All	All data could be changed or deleted
E	Theoretical	No public exploit code is known
TD	Default	Default or common setups are exposed

"Theoretical" is the one hopeful part. It means nobody had published working attack code when the advisory went out. Neither source reports attacks in the wild.

Which Drupal versions need the update

Branch	Affected	Fixed in
Drupal 11.4.x	Every release below 11.4.10	11.4.10
Drupal 11.3.x	Every release below 11.3.19	11.3.19
Drupal 10.6.x	Every release below 10.6.19	10.6.19
Drupal 12 test releases	12.0.0-alpha1 to 12.0.0-beta1	Range ends before 12.0.0-beta2
11.2.x and older, 10.5.x and older, 9, 8.9	Affected, end of life	No fix

The last row matters most for older sites. Pantheon's release note lists those branches as end-of-life, so they will get no patch. Pantheon is a large Drupal hosting company. Its advice is to move those sites to a supported release.

The advisory credits Drew Webber and Octavio Galland with reporting the bug. Drupal security team members catch, Lee Rowlands, Dave Long, Drew Webber and Jess wrote the fix.

An add-on module got the same rating

The same day, Drupal published SA-CONTRIB-2026-218 for Entity List. It is a contributed module that builds lists of entities, Drupal's name for content items and other records, without the Views tool. It is also a critical code execution flaw, scored 19 out of 25.

Versions before 3.0.10 are affected, and 3.0.10 fixes it. That advisory says plainly: "At least one known exploit path does not require authentication." It offers no workaround, so updating is the only fix.

What this means for developers

Update core first. Move each site to 11.4.10, 11.3.19 or 10.6.19, whichever matches its branch. On a Composer-managed site, that means updating the core package and deploying, then checking that the site's status report shows the new version. Pantheon customers can use the one-click core update in the dashboard. "Update your Drupal sites to a patched release as soon as possible," Pantheon's note says.

If you cannot update today, uninstall the core Field UI module. The advisory says this "will provide protection while sites are updated." Field UI is only needed while someone changes a site's structure, so many live sites can run without it for a while. Check first that no other installed module depends on it. Turn it back on after the update.

Check your add-ons next. Any site running Entity List needs version 3.0.10. Because the core flaw is reached through contributed and custom code, review any custom module that calls Field UI features from a public page.

Do not count on a firewall alone. The advisory says Drupal Steward, the security team's firewall service, blocks some known attack paths but not all. It still tells covered sites to upgrade.

Treat end-of-life sites as exposed. Drupal 9 and older 10.x or 11.x sites will not get a patch. Uninstalling Field UI is the fastest stopgap while you plan the move to a supported branch.

Watch your logs this week. The fix is public, and attackers study patches to find the weak spot. In September, WordPress shipped a security release for a similar code execution bug, and the advice there holds here too: patch every environment, staging included.