Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication

Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in.

Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026.

The official security advisory, SA-CORE-2026-014, assigns the issue a risk score of 19 out of 25 under Drupal’s rating system. Successful exploitation could expose all private website data and allow attackers to change or delete information. The score is not a CVSS rating.

The most important detail is that Drupal core alone does not provide a direct path to exploit the flaw. However, the security team confirmed that several serious attack paths exist when contributed modules are present. These are additional modules used to extend a website’s features beyond its core functions.

At least one known attack path requires no authentication, meaning an attacker would not need a valid account. Custom website code may also expose the vulnerable functionality. Site owners should consider installed extensions and custom development, rather than judging exposure by Drupal version alone.

Critical Drupal RCE Vulnerability

The public advisory does not name the contributed modules involved or provide a working exploit. Its rating describes exploitation as theoretical, with no public exploit code or development documentation. That wording should not be mistaken for proof of safety, given the confirmed attack paths described by the security team.

The issue follows earlier concerns about Drupal security, including coverage of a Drupal core SQL injection vulnerability. That report concerns a separate flaw.

Its exploitation status should not be applied to this Field UI vulnerability, for which the current advisory does not report attacks in the wild.

The affected ranges cover Drupal versions from 8.9.0 before 10.6.19, 11.0.0 before 11.3.19, and 11.4.0 before 11.4.10. Drupal 12 development releases from 12.0.0-alpha1 before 12.0.0-beta2 are also affected.

The broad version coverage makes it important to check every deployed site, especially where organizations maintain several Drupal installations.

Administrators running Drupal 11.4.x should install Drupal 11.4.10. Those using Drupal 11.3.x should move to 11.3.19, while Drupal 10.6.x users should install 10.6.19. Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, and Drupal 8 and 9 no longer receive security coverage.

Drupal says uninstalling the core Field UI module (field_ui) protects while sites are updated. Drupal Steward also blocks some known attack paths, but it doesn’t cover every possible exploit. Organizations using that service still need to upgrade rather than treat filtering as a permanent fix.

For teams reviewing possible compromise, guidance on detecting and investigating webshells offers useful background on malicious scripts that enable remote commands. The immediate priority for this vulnerability remains clear.

Apply the supported security release, or uninstall Field UI while preparing the update, without relying solely on partial network protection measures.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication appeared first on Cyber Security News.