/
← Voltar ao feed
critical government education non-profit

Drupal discloses critical Field UI RCE flaw CVE-2026-108097 exploitable via contributed modules, including an unauthenticated path

3 fonte(s) · 3 atualização(ões) · publicado 17/10/2026 11:32 · coletado há 1 dia

Drupal published an advisory on October 14, 2026 for CVE-2026-108097, a critical remote code execution vulnerability in the Field UI module (field_ui) of Drupal core. The advisory gives it a risk score of 19/25, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. Drupal core alone is not directly exploitable, but several contributed modules create serious attack paths, at least one of them unauthenticated, and custom code can also expose the vulnerable function. The exploit status is rated theoretical and no active exploitation is reported. The flaw was reported by Drupal Security Team member Drew Webber and researcher Octavio Galland.

Technical Details

  • Affected: Drupal 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, and 11.4.0 to before 11.4.10. Drupal 12.0.0-alpha1 to before 12.0.0-beta2 is also listed.
  • The advisory does not name the contributed modules involved, publish an exploit, or describe the triggering requests.
  • Drupal 10.5.x and earlier, 11.2.x and earlier, and Drupal 8 and 9 no longer receive security coverage.
  • No malware family or threat actor is identified.

Remediation

  • Update to 10.6.19, 11.3.19 or 11.4.10, depending on the branch in use.
  • As a workaround, uninstall the core Field UI module (field_ui). Hiding its interface or restricting menu access is not equivalent protection.
  • Drupal Steward covers some known attack paths but not all, so subscribers must still upgrade.
  • Migrate sites on end-of-life branches to a supported release.

Linha do tempo

  1. gbhackers.com ↗ · pub. 19/10/2026 09:39 · coletado 19/10 17:54

    Drupal discloses critical Field UI RCE flaw CVE-2026-108097 exploitable via contributed modules, including an unauthenticated path

    This article adds detail on CVE-2026-108097 beyond the existing case: the advisory date (October 14, 2026), the 19/25 risk score, the theoretical exploit status, and the credit to Drew Webber and Octavio Galland for reporting the flaw. It also says Drupal Steward only partially mitigates the issue and that Drupal 12 pre-release builds are affected.

    ler a análise desta fonte

    This article adds detail on CVE-2026-108097 beyond the existing case: the advisory date (October 14, 2026), the 19/25 risk score, the theoretical exploit status, and the credit to Drew Webber and Octavio Galland for reporting the flaw. It also says Drupal Steward only partially mitigates the issue and that Drupal 12 pre-release builds are affected.

    Drupal published an advisory on October 14, 2026 for CVE-2026-108097, a critical remote code execution vulnerability in the Field UI module (field_ui) of Drupal core. The advisory gives it a risk score of 19/25, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. Drupal core alone is not directly exploitable, but several contributed modules create serious attack paths, at least one of them unauthenticated, and custom code can also expose the vulnerable function. The exploit status is rated theoretical and no active exploitation is reported. The flaw was reported by Drupal Security Team member Drew Webber and researcher Octavio Galland.

    Technical Details

    • Affected: Drupal 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, and 11.4.0 to before 11.4.10. Drupal 12.0.0-alpha1 to before 12.0.0-beta2 is also listed.
    • The advisory does not name the contributed modules involved, publish an exploit, or describe the triggering requests.
    • Drupal 10.5.x and earlier, 11.2.x and earlier, and Drupal 8 and 9 no longer receive security coverage.
    • No malware family or threat actor is identified.

    Remediation

    • Update to 10.6.19, 11.3.19 or 11.4.10, depending on the branch in use.
    • As a workaround, uninstall the core Field UI module (field_ui). Hiding its interface or restricting menu access is not equivalent protection.
    • Drupal Steward covers some known attack paths but not all, so subscribers must still upgrade.
    • Migrate sites on end-of-life branches to a supported release.
  2. securityweek.com ↗ · pub. 19/10/2026 12:47 · coletado 19/10 17:53

    Drupal patches five flaws, including critical RCE bugs in Field UI and Entity List; fast exploitation expected

    This article adds three fixes beyond the two RCE flaws already covered: XSS vulnerabilities in the core Link module (CVE-2026-108515) and Navigation module (CVE-2026-108514), plus an XSS bug in the Gin admin theme (fixed in 5.0.16 and 4.1.4). It also states that Drupal reports no in-the-wild exploitation and recalls its October 12 warning that exploits might appear within hours or days.

    ler a análise desta fonte

    This article adds three fixes beyond the two RCE flaws already covered: XSS vulnerabilities in the core Link module (CVE-2026-108515) and Navigation module (CVE-2026-108514), plus an XSS bug in the Gin admin theme (fixed in 5.0.16 and 4.1.4). It also states that Drupal reports no in-the-wild exploitation and recalls its October 12 warning that exploits might appear within hours or days.

    Drupal released patches for five vulnerabilities, including two critical remote code execution flaws: CVE-2026-108099 in the contributed Entity List module and CVE-2026-108097 in the Field UI module of Drupal core. Neither is exploitable on its own, but contributed modules provide exploit paths, and at least one of them requires no authentication. Drupal does not report exploitation in the wild. On October 12, however, it warned that exploits might be developed within hours or days, so defenders should prioritize patching. The update also fixes several cross-site scripting (XSS) bugs in the Link module, the Navigation module and the Gin admin theme.

    Technical Details

    • CVE-2026-108099: RCE in Entity List. It is exploitable only through other contributed modules, and at least one known path is unauthenticated. Custom code may also expose the vulnerable functionality.
    • CVE-2026-108097: RCE in the core Field UI module. Contributed modules provide serious exploit paths, including at least one that needs no authentication.
    • CVE-2026-108515: XSS flaws in the core Link module.
    • CVE-2026-108514: XSS flaw in the core Navigation module.
    • An XSS issue in the Gin administration theme (no CVE given in the article).
    • Previous Drupal releases are end-of-life and receive no security updates.

    Remediation

    • Update Drupal core to 11.4.10, 11.3.19 or 10.6.19.
    • Update Entity List to 3.0.10.
    • Update Gin to 5.0.16 or 4.1.4.
    • As a mitigation for CVE-2026-108097, uninstall the core Field UI module.
    • Migrate sites on end-of-life branches to a supported release.
  3. bleepingcomputer.com ↗ · pub. 17/10/2026 11:32 · coletado 19/10 17:53 primeiro registro

    Drupal patches critical RCE flaws CVE-2026-108097 and CVE-2026-108099 in Field UI and Entity List; exploits expected soon

    ler a análise desta fonte

    Drupal patched two critical remote code execution vulnerabilities affecting all supported versions of Drupal core (Field UI module) and the contributed Entity List module. The Drupal Security Team issued an advance warning, saying exploits could appear within hours or days of disclosure. Both flaws have at least one known exploitation path that requires no authentication when combined with contributed modules or custom code. The article does not report active exploitation. Drupal powers more than one million websites and is popular with government agencies, universities and non-profits.

    Technical Details

    • CVE-2026-108097: RCE in Drupal core's Field UI (field_ui) module. It cannot be exploited with core alone, but contributed modules provide multiple exploitation paths, including at least one that needs no authentication. Custom code may also expose the vulnerable functionality.
    • CVE-2026-108099: RCE in Entity List, a contributed module for creating entity lists without Views. It requires a similar interaction with contributed modules or custom code and has at least one known unauthenticated exploitation path.
    • Drupal 12 pre-releases before beta2 are also affected; the stable 12.0 release will include fixes.
    • Drupal versions before 10.6.x and Drupal 11 versions before 11.3.x are end-of-life and receive no fixes.

    Remediation

    • Update Drupal core to 10.6.19, 11.3.19 or 11.4.10, depending on the release branch.
    • Update Entity List to 3.0.10.
    • If an upgrade is not possible, uninstall the core Field UI (field_ui) module as a mitigation.
    • Drupal Steward blocks some known attack vectors but does not cover every possible exploit.
    • Sites on end-of-life branches should migrate to a supported version.