In the week starting October 4, 151,442 of the 531,499 sites that reported their Drupal core version to drupal.org — 28.5% — were on a branch the advisory lists as affected and that received no fix.
What was released and why it matters
On October 14 the Drupal Security Team shipped patches for a critical remote code execution flaw in core's Field UI module: Drupal 11.4.10, 11.3.19, and 10.6.19. The issue is tracked as CVE-2026-108097 and rated 19 out of 25 on Drupal's risk scale — the project's "critical" level. The Security Team credited Drew Webber and Octavio Galland for reporting the bug.
The advisory stressed that core alone does not expose the flaw; several exploit paths exist through contributed modules and custom code, and the project said at least one known path needs no login. As of publication, the advisory reported no publicly available exploit code, and by October 15 none had surfaced in public reports.
How the vulnerability worked in Field UI
Field UI builds its administrative tables from Drupal render arrays. Before the fix, the table element's pre-render step ran whatever PHP callable each table row carried in its #region_callback property via call_user_func_array without checking the callable. Drupal's renderer has refused to run untrusted render callbacks since version 8.8 in 2019; because the renderer trusts the table element's own methods the safeguard never reached the callable the pre-render step executed.
The code change in 11.4.10 stops calling that callback. Instead, it reads each row's region from the row's own region value and uses the table's hidden region, or its first region, when the value is not a known region. That same call had been present in core since at least Drupal 8.9.0 in 2020. In core, the callback was set only by Field UI's own display forms; custom code that set #region_callback on a field_ui_table row will find it no longer runs after updating.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhich releases are fixed, which are not, and related advisories
- Update targets the affected supported branches: 11.4.x → 11.4.10; 11.3.x → 11.3.19; 10.6.x → 10.6.19.
- Drupal 12.0.0 beta received 12.0.0-beta2, which the advisory notes is not for production use.
- No fixes are available for Drupal 11.2.x and below, 10.5.x and below, and Drupal 8 and 9 — all end-of-life.
- Both 11.3.x and 10.6.x will lose security coverage in December 2026.
Separately, the contributed Entity List module received its own critical RCE advisory as CVE-2026-108099; its 3.0.10 release notes say the fix mirrors the Field UI change. Updating core does not update contributed modules; in the week starting October 4, 90 sites reported using Entity List. The same core releases also fix two moderately critical XSS flaws: CVE-2026-108515 (Link module) and CVE-2026-108514 (Navigation module), both requiring at least a logged-in user.
Pantheon noted that Drupal 7 reached end of life on drupal.org in January 2025, but that its Drupal 7 long-term support with Tag1 Consulting shipped Drupal 7.107 with a backport of the fix.
Contributed modules, WAF coverage, and the no-login risk
The advisory does not name the contributed modules that open exploit paths; it warns that custom code may also expose the flaw. At least one known exploit path requires no login, increasing the urgency for public-facing sites. Drupal Steward — a web application firewall service with rules written by the Security Team — already blocks some known attack vectors for this flaw; Acquia, Pantheon, Ironstar, and Skpr run Drupal Steward for their customers. The advisory cautioned that the WAF does not cover every possible exploit and those sites should still update.
Action for operators, module authors, and hosting providers
Site operators should update to the fixed release for their supported branch as listed above. If a site cannot update immediately, the advisory offers a temporary mitigation: uninstall the Field UI module, field_ui, which "will provide protection while sites are updated." Uninstalling Field UI disables the admin pages for managing fields and their display.
Pantheon advises sites to check any custom code that set #region_callback and to test the manage fields and manage display pages after updating. Module authors must release updates separately — as Entity List shows, fixing core does not automatically fix contributed modules.
The Security Team pre-announced the release on October 12 and told sites to reserve time for the update "because exploits might be developed within hours or days." The advisory also noted that in May Drupal reported exploit attempts within two days of an advisory for a different core SQL injection flaw, and that CISA added that earlier flaw to its catalog of exploited vulnerabilities — a reminder of how quickly exploit activity can follow a disclosure.
A fix is in hand, but many reported sites remain on affected branches without one. With at least one known no-login path via contributed code and evidence that exploit attempts can follow advisories in days, the immediate choices are clear: apply the security updates, remove Field UI until you can, and check contributed modules and custom callbacks that touch #region_callback. The next question is whether exploit code will appear before administrators complete those steps.
