On 14 October Drupal patched a critical remote code execution flaw in the Field UI module, tracked as CVE-2026-108097. Drupal scores it 19 out of 25. The project warned before release that exploits could appear within hours or days. As of 15 October, public reporting had not confirmed attacks in the wild.
What happened
Advisory SA-CORE-2026-014 says the flaw sits in Field UI, the core module used to manage fields. Drupal says core on its own cannot be used to exploit it. Contributed modules open several serious paths, and at least one known path needs no login. Custom code can expose the same function. Drupal Steward covers some known vectors, not all of them.
Who is affected
- Drupal 10.6.x before 10.6.19
- Drupal 11.3.x before 11.3.19, and 11.4.x before 11.4.10
- Drupal 11.0.0 and later below those fixed releases, and Drupal 8.9.0 up to but not including 10.6.19
- Drupal 12.0.0-alpha1 through 12.0.0-beta1. Drupal 11.2.x and earlier, and Drupal 10.5.x and earlier, are end of life and get no patch
What to do now
Update supported sites this week. If you cannot, uninstall the field_ui module until you can.
- Move 10.6.x to 10.6.19, 11.3.x to 11.3.19, and 11.4.x to 11.4.10.
- If an update has to wait, uninstall the core Field UI module (field_ui). Drupal says that blocks the flaw until the site is updated.
- Do not treat Drupal Steward as a full fix. It covers some known paths only.
- Sites on end-of-life branches (11.2 and earlier, 10.5 and earlier, Drupal 8 and 9) need a move to a supported release. There is no patch for those lines.
What this means for South African businesses
Drupal is less common than WordPress in local SME stacks, but it still runs membership sites, universities, NGOs and a few agency-built company sites. The practical risk is not the core version number. It is whether a contributed module or old custom code opens the unauthenticated path, which an MSP often cannot see from the hosting panel alone. Check the Drupal version and whether field_ui is enabled before you assume the site is out of scope.
Source: Drupal SA-CORE-2026-014.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.