Drupal ships a fix for a critical Field UI advisory

The advisory

Drupal's SA-CORE-2026-014 is dated October 14, 2026. It is CVE-2026-108097. Drupal rates it critical, 19 out of 25, and describes remote code execution in Field UI. The advisory says core by itself does not expose the bug. Contributed modules and custom code can, and at least one path does not require an account. The security desk's standing rule, that the advisory is the story, is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.the advisory is the story.

The mitigation the advisory names

Uninstall the core Field UI module, which Drupal calls field_ui. That is the mitigation in the advisory. This page will not add a command line, a package invocation, or a function name. A site owner who needs the commands has the advisory and the release notes. Pantheon's October release note is one host's account that the core update shipped. The security desk is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.Security.

The versions that receive a fix

Drupal 11.4.10, 11.3.19, and 10.6.19 contain the fix. Drupal 12 is covered before 12.0.0-beta2. Drupal 11.2 and older, 10.5 and older, and all of Drupal 8 and 9 are end of life and do not get this patch. An end-of-life major version stays vulnerable if the site still runs it. The 11.4.10 release note is the version page. Software is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.Software.

The two other advisories

The same day Drupal published SA-CORE-2026-015, CVE-2026-108515, and SA-CORE-2026-016, CVE-2026-108514. Both are moderately critical cross-site scripting issues, and both are fixed in the same releases as the Field UI bug. This brief names them so a reader does not think October 14 was a single note. It does not describe the scripting bugs. The paper is Asked directly, Which releases contain the fix? Drupal 11.4.10, 11.3.19, and 10.6.19. Drupal 12 is fixed before 12.0.0-beta2. Branches 11.2 and below, 10.5 and below, and Drupal 8 and 9 are end of life and do not receive the fix.Futureweb.

The warning from two days earlier

PSA-2026-10-12 told administrators that a security window was coming on October 14. The advisories are that window. A public service announcement is not the fix. The fix is the release, plus the Field UI mitigation for sites that cannot update the same day. Open source, for the project that ships the core, is Asked directly, What mitigation does the advisory name? Uninstall the core Field UI module, field_ui. This page is not adding commands. The document named in the sources is the record this page will keep.Open Source.

What The Hacker News is for

The Hacker News reported that Drupal had patched a critical core flaw. That is the outside account. Pantheon is a host note. Drupal.org is the advisory. Impact and scope come from the advisory. A news write-up does not add an exploit path this page would then repeat. Hardware is Asked directly, Does a plain core site expose it? Drupal says it is not directly exploitable with core alone. Contributed modules and custom code can expose it, and at least one path does not require authentication.Hardware.

Who is in scope

Sites that expose Field UI through contributed or custom code are in the advisory's scope, including at least one path with no account. Sites that do not enable that exposure are the ones Drupal says are not directly reachable through core alone. End-of-life majors are in scope for the risk and out of scope for the fix. Privacy is Asked directly, Were there other advisories the same day? Yes. SA-CORE-2026-015, CVE-2026-108515, and SA-CORE-2026-016, CVE-2026-108514, are moderately critical cross-site scripting issues fixed in the same releases. This page does not describe how they work. PSA-2026-10-12 had warned that fixes were coming in the October 14 window.Privacy.

What this page will not add

No callback name, no request shape, no package command. The identifier, the score, the versions, and the uninstall mitigation are the operable public facts. Anything past that is an exploit note, and this desk does not file those. Energy is Asked directly, What is the identifier? SA-CORE-2026-014, CVE-2026-108097, critical, 19 out of 25. Drupal dated the advisory October 14, 2026. The affected component is Field UI. The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.Energy.

How it sits beside the catalog

A Drupal advisory is not a CISA catalog entry unless CISA adds it. The four exploited vulnerabilities added the same week are a different brief. Readers who came for the catalog want that page, not this one. Networking is The short answer this page will stand on is this: A critical remote-code-execution flaw in Field UI, CVE-2026-108097, scored 19 out of 25. Core alone does not expose it. Contributed or custom code can, and at least one path does not require an account. Fixes are Drupal 11.4.10, 11.3.19, and 10.6.19. The advisory's mitigation is to uninstall the Field UI module.Networking.