● Covered by 3 sources · 6 reportsMedium impact3 negative3 neutral
Drupal Patches Critical Field UI Flaw Allowing Unauthenticated RCE via Contributed Modules
Key points
- Critical RCE flaw CVE-2026-108097 found in Drupal Field UI module.
- Exploitable via contributed modules, some paths require no authentication.
- Patches released for Drupal 11.4.10, 11.3.19, and 10.6.19.
- Uninstalling Field UI module provides temporary protection.
- Critical RCE flaw CVE-2026-108099 found in contributed Entity List module.
- Drupal issued an advance warning about exploits emerging soon.
- Drupal recommends updating before October 14.
- Over one million websites run on Drupal.
- CVE-2026-108099 in Entity List module is not exploitable alone.
- CVE-2026-108097 in Field UI module is not exploitable alone.
- Update to Entity List version 3.0.10.
- Previous Drupal releases reached end-of-life.
- Updates resolve XSS holes in Drupal core Link module.
- Critical authorization bypass flaw CVE-2026-118539 found in Drupal Commerce Core.
- CVE-2026-118539 affects Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
- CVE-2026-118539 allows access bypass, potentially impacting vendors financially.
- CVE-2026-118539 is being actively exploited in the wild.
- Update to Commerce Core 3.3.13 for version 3.x.
- Update to Commerce Core 8.x-2.41 for earlier versions.
- Dan Puccetti, Marcus Johansson, and Robert Snyder reported the flaw.
- Commerce Core module is used by over 42,000 websites.
- Drupal security team gave CVE-2026-118539 a risk score of 21 out of 25.
Critical Vulnerability Discovered
Drupal core has addressed a critical vulnerability, tracked as CVE-2026-108097, within its Field UI module. This flaw could enable an attacker to execute arbitrary code on the server. The Drupal Security Team rated this vulnerability as critical, scoring 19 out of 25 on their risk scale.
Exploitation Path and Impact
While the flaw is not directly exploitable through Drupal core alone, several contributed modules create pathways for exploitation. At least one known exploit path does not require authentication. The advisory did not specify which contributed modules are affected, and custom code may also expose the vulnerability. Drew Webber and Octavio Galland are credited with reporting the issue.
Required Updates
To mitigate the risk, users should update their Drupal installations immediately. The patched versions are 11.4.10 for Drupal 11.4.x, 11.3.19 for 11.3.x, and 10.6.19 for 10.6.x. Drupal 12.0.0-beta2 also includes the fix but is not recommended for production use. Older, end-of-life versions of Drupal (11.2.x and below, 10.5.x and below, and Drupal 8 and 9) will not receive fixes.
Temporary Mitigation and Coverage
For sites unable to update immediately, uninstalling the Field UI module (field_ui) will provide temporary protection, though it will disable administrative pages for managing fields. The Field UI module is part of Drupal's Standard install profile, meaning many sites have it installed by default. As of October 4, approximately 28.5% of reported Drupal sites were on affected branches without a fix.
Drupal Steward, a web application firewall service, already blocks some known attack vectors for this flaw, but it does not cover all possible exploits. Sites using Drupal Steward should still proceed with updates.
Exploit Status
At the time of the advisory's publication and as of October 15, no publicly available exploit code or active attacks utilizing this vulnerability had been reported. The Drupal Security Team pre-announced the release, advising users to prepare for updates due to the potential for rapid exploit development.
Updates
- Drupal security team gave CVE-2026-118539 a risk score of 21 out of 25.
- Critical authorization bypass flaw CVE-2026-118539 found in Drupal Commerce Core.
- CVE-2026-118539 affects Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
- CVE-2026-118539 allows access bypass, potentially impacting vendors financially.
- CVE-2026-118539 is being actively exploited in the wild.
- Update to Commerce Core 3.3.13 for version 3.x.
- Update to Commerce Core 8.x-2.41 for earlier versions.
- Dan Puccetti, Marcus Johansson, and Robert Snyder reported the flaw.
- Commerce Core module is used by over 42,000 websites.
- CVE-2026-108099 in Entity List module is not exploitable alone.
- CVE-2026-108097 in Field UI module is not exploitable alone.
- Update to Entity List version 3.0.10.
- Previous Drupal releases reached end-of-life.
- Updates resolve XSS holes in Drupal core Link module.
- Critical RCE flaw CVE-2026-108099 found in contributed Entity List module.
- Drupal issued an advance warning about exploits emerging soon.
- Drupal recommends updating before October 14.
- Over one million websites run on Drupal.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-108097 CVE CVE-2026-108099 CVE CVE-2026-108515 CVE CVE-2026-108514 CVE CVE-2026-118539 CVE CVE-2026-1096189.8 CRITICALHow outlets covered it
Drupal is urging online store owners to patch a critical access bypass vulnerability, CVE-2026-118539, in its Commerce Core module, as it is being actively exploited. The flaw affects over 42,000 sites using the module and could lead to financial impact for vendors by allowing unauthenticated attackers to bypass access controls.
Drupal has issued a warning about a critical access bypass vulnerability (CVE-2026-118539) in its Commerce Core module, which is currently being exploited by attackers. The flaw affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13, allowing unauthenticated attackers to bypass authorization and potentially cause financial impact to vendors. Admins are advised to upgrade immediately to Commerce Core 3.3.13 (or 8.x-2.41) and audit orders for inconsistencies.
Drupal has issued a warning regarding a "highly critical" authorization bypass vulnerability in its Commerce Core component, which is currently being actively exploited. The flaw, affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, allows access bypass that could financially impact vendors. Users are advised to update to the latest Commerce Core versions immediately.
Drupal released patches for five vulnerabilities, including two critical remote code execution (RCE) flaws, CVE-2026-108099 and CVE-2026-108097, affecting the Entity List and Field UI modules. These vulnerabilities, which can be exploited without authentication when combined with other modules, prompted Drupal to advise immediate updates due to potential rapid exploitation.
Drupal released patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 and CVE-2026-108099, affecting its core Field UI module and the contributed Entity List module. These flaws could allow attackers to execute arbitrary code on affected websites, prompting an urgent call for administrators to update their installations.
Drupal released patches for a critical vulnerability, CVE-2026-108097, in its Field UI module that could lead to unauthenticated remote code execution (RCE) through specific contributed modules. Users are advised to update to versions 11.4.10, 11.3.19, or 10.6.19, or uninstall the Field UI module if immediate updates are not possible.