Drupal core addresses a critical remote code execution vulnerability in the Field UI module (CVE-2026-108097), alongside fixes for Link and Navigation module flaws.
Learn which versions include the patches and how unsupported branches are affected.
Who is affected and what applies?
The issue cannot cause damage by itself through the base code, but requires the use of additional functions or custom code to be compromised. However, at least one attack path does not require any kind of login on the part of the attacker. The responsible team assessed the issue as extremely serious.
The administrators released updates on October 14, 2026 for the supported versions of the system:
- 11.4 series: update to version 11.4.10
- 11.3 series: update to version 11.3.19
- 10.6 series: update to version 10.6.19
- Series 12 (test): update to new test version
Older, unsupported versions, such as 11.2, 10.5 and earlier, as well as Drupal 8 and 9, will not receive any fixes. Data from the week of October 4 showed that nearly 28% of websites reporting their version were using unsupported versions that are affected. Additionally, Pantheon has released an update for Drupal 7 through its long-term support program.
READ ALSO
New security fixes from Ahsay Backup for AhsayCBS after incomplete measures
Alternative protection and additional issues
For sites that cannot immediately update their code, the security team recommends temporarily removing the specific field management section to provide protection until the upgrade is complete. Meanwhile, website protection services such as Drupal Steward block some known attack attempts, although administrators are still advised to update. As of October 15, there were no ready-made attack tools available or reports of actual incidents.
At the same time, a separate software add-on, Entity List, received its own fix for a similarly serious remote control issue with version 3.0.10. At the same time, the same core system updates also fix two less serious issues related to link and navigation security.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)