Drupal patches critical Field UI flaw opening an unauthenticated remote code execution path via contributed modules

Drupal patched CVE-2026-108097, a flaw in the Field UI module it rates 19 out of 25 on its own critical scale. Field UI built admin tables that ran each row's region callback through call_user_func_array without checking the callable, a path present since Drupal 8.9.0 in 2020, and the fix stops calling the callback. Several exploit paths run through contributed modules, and at least one needs no login, raising an unauthenticated remote code execution risk. Fixes are in 11.4.10, 11.3.19, and 10.6.19, with no fix for end-of-life branches. No exploit was public as of mid-October, but the team warned exploits could appear within hours.

Check

Update Drupal core to 11.4.10, 11.3.19, or 10.6.19, or uninstall the field_ui module until you can, and plan migration off end-of-life branches.

Affected

Drupal sites on affected or end-of-life versions expose a Field UI flaw with exploit paths through contributed modules, at least one requiring no authentication, risking remote code execution.

Fix

Apply the Drupal core fixes or disable field_ui, audit contributed modules for the vulnerable path, and prepare for rapid exploit development by monitoring and patching quickly.