Drupal discloses critical Field UI RCE flaw CVE-2026-108097 exploitable via contributed modules, including an unauthenticated path
Drupal published an advisory on October 14, 2026 for CVE-2026-108097, a critical remote code execution vulnerability in the Field UI module (fieldui) of Drupal core. The advisory gives it a risk score of 19/25, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. Drupal core alone is not…