Drupal core: critical remote code execution in Field UI (CVE-2026-108097, SA-CORE-2026-014) plus related XSS and contrib flaws
Published 27/10/2026 11:00
Timeline
2 events over 8 d
- 19/10/2026 10:08ConfirmedNCSC-NL advisories+8 d
- 27/10/2026 11:00Published on WatchtowerPro CISO
In short
Drupal core has a critical remote code execution flaw in the Field UI module (CVE-2026-108097). It can only be exploited when a contrib or custom module passes request data into Field UI tables, and some attack paths need no login. Fixed core releases are out, so update now. Related XSS flaws and a contrib remote code execution flaw were fixed at the same time. Shodan estimates about 15,257 internet-facing Drupal servers worldwide, 2,654 of them in the EU (27/10/2026); how many run an affected version is not yet known.
How bad is it
Critical: an attacker can run code on a Drupal site, in some cases without logging in, if a contrib or custom module passes request data into Field UI tables.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
No CVSS score published yet
A missing score is never read as 0.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Drupal core, SA-CORE-2026-014 (Field UI RCE) and SA-CORE-2026-015 (Link XSS): 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, 11.4.0 to before 11.4.10, and 12.0.0-alpha1 to before 12.0.0-beta2.
- Drupal core, SA-CORE-2026-016 (Navigation XSS): the same ranges, but starting at 10.3.0.
- Exploiting the core flaw needs a contrib or custom module that turns request data into Field UI tables or render arrays. Core alone cannot be exploited.
- Entity List contrib module (SA-CONTRIB-2026-218, CVE-2026-108099): remote code execution with at least one known exploit path that needs no login. Affected versions are not yet known.
- Gin admin theme (SA-CONTRIB-2026-219, CVE-2026-110738): versions before 4.1.4, and 5.0.0 to before 5.0.16 (secondary source).
- The XSS flaws matter most where users have the 'administer menu' permission or may enter HTML with data attributes.
Fixed in
- 10.6 branch: 10.6.19
- 11.3 branch: 11.3.19
- 11.4 branch: 11.4.10
- 12.0 branch: 12.0.0-beta2
- 8.9: no fix
What to do now
- Update Drupal core now to the fixed release for your line: 10.6.19 (10.6.x), 11.3.19 (11.3.x), 11.4.10 (11.4.x) or 12.0.0-beta2 (12.x pre-release). Sites on 8.9, 9.x, 10.0–10.5 or 11.0–11.2 have no official fix. Move them to a supported line (10.6.19 or later) as soon as possible.
- Update the Gin admin theme to 5.0.16, or 4.1.4 on core below 11.2. Sites on core 11.4 must use Gin 5.0.16.
- If the Entity List contrib module is installed, uninstall it unless it is needed. No fixed version is known yet.
- Until the update is installed, uninstall the Field UI module where nobody needs to build site structure.
- If the site has Drupal Steward, keep it active. It is only a partial mitigation.
- Ask your developer to list contrib and custom modules that build render arrays or tables from request data. Do not install unknown or untrusted modules.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Drupal, at which version, fixed or not - and what each one needs.
Main sources
NCSC-2026-0438 [1.00] [M/H] Kwetsbaarheden verholpen in Drupal Core en modules door Drupal CERT · [NEU] [mittel] Drupal Module (View Unpublished, Simple OAuth und Domain Login Restrict): Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen CERT · NCSC NL Research