Most critical vulnerabilities live in the scary parts of a codebase, like authentication, file uploads, or that one regex nobody understands. This week's Drupal bug was hiding in Field UI, the admin screen you use to add a "Subtitle" field to your Article content type. It's the coding version of a burglar coming in through the cat flap.
A 19-Out-of-25 Wake-Up Call
On October 14, the Drupal Security Team released SA-CORE-2026-014, a critical remote code execution flaw in core's Field UI module, tracked as CVE-2026-108097 and rated 19 out of 25. The fixes are in Drupal 11.4.10, 11.3.19, and 10.6.19. Drupal 11.2.x and earlier, 10.5.x and earlier, and Drupal 8 and 9 get no patch because they are all end-of-life.
The root cause: Field UI's table pre-render step passed each row's #region_callback to call_user_func_array without validating it, and that code had been there since at least Drupal 8.9.0 in 2020. Core alone can't reach the flaw, but the advisory says several exploit paths exist through contributed modules, and at least one of them needs no login. A related critical flaw in the contributed Entity List module (CVE-2026-108099) was fixed in version 3.0.10, and updating core does not update that module.
28.5% of Sites Missed the Memo
The Security Team announced the release two days early and warned that exploits "might be developed within hours or days." When the advisory went out, no public exploit or reported attacks existed. That doesn't buy much time. In May, attackers went after a Drupal core SQL injection advisory within two days, and CISA later added that flaw to its Known Exploited Vulnerabilities catalog. Meanwhile, in the week starting October 4, 151,442 of 531,499 reporting sites (about 28.5%) were on an affected branch that won't get a fix.
The detail most teams will miss: the patch removes the callback entirely. Custom code that sets #region_callback on field_ui_table rows will silently stop running, so test your Manage Fields and Manage Display pages after updating. If you can't update right away, the advisory says uninstalling field_ui will protect the site in the meantime, though editors lose those admin screens. Drupal Steward's WAF rules block some known attack vectors but not all of them. Also, 11.3.x and 10.6.x lose security coverage in December 2026, so your next upgrade is coming soon either way.
Patch now, check the custom code, and if your site is still on Drupal 9, it isn't "stable." It's unpatched.
If this advisory showed you that your Drupal site is on an end-of-life branch or full of mystery custom code, our Drupal team can help you patch it, audit it, and plan an upgrade that holds up past December.
Source: The Hacker News