Drupal core Field UI remote code execution (CVE-2026-108097)

The flaw is in Field UI, the Drupal core module behind the admin screens where site builders manage fields and display settings. Field UI builds its tables from data. One line of core code took a function name stored in a table row and ran it, with the row as its argument. The advisory calls the result remote code execution. In 11.4.10 that line is gone, and the UK security firm Fortbridge says the deletion is the whole fix.

Why Core Alone Is Not Enough

Drupal says the flaw is not directly exploitable with core alone. It says several serious exploit paths exist with contributed modules, that at least one needs no login, and that custom code may expose it too. Fortbridge splits the problem in two. The sink is the core line, present on every stock install. The writer is contributed or custom code that lets a web request choose what goes into a table row.

Core has no such writer. The only core Field UI table Fortbridge found sits on an admin form, and an anonymous request gets a 403 error. Using a made up writer module in its own lab, Fortbridge showed that the sink can end in code running on the server. It labels that module synthetic.

No Public Writer Module Has Been Named

Fortbridge checked 117 candidate modules against their source and cloned 250 projects. It reports that no public contributed module uses the pattern today. The only one that ever did is Entity List, covered below. Its reading is that real exposure is Entity List plus custom code in your own modules. That is one firm's reading, not a Drupal statement.

Drupal rates the flaw Critical, 19 out of 25 on its own scale, with exploit maturity marked Theoretical. NVD had no record for the CVE on 23 October, so there is no official CVSS score. Fortbridge says that scored as exploitable it would be 9.8 on CVSS 3.1, and 8.1 with high attack complexity. Those are its own figures. It adds that the moment a real writer module is named, it becomes a 9.8.

What Our Checks Showed

CISA had not listed the CVE in the Known Exploited Vulnerabilities (KEV) catalog file CISA released on 21 October. Drupal did warn on 12 October that exploits might be developed within hours or days of the release, so the window to update is short.

GitHub: on 23 October our searches found 4 repositories, each with 0 stars. We read them and did not run or link them. One is a short detector that calls itself defensive. One is the Fortbridge research pack, whose README says the writer module in it is synthetic. One is a teaching lab with its own deliberately vulnerable module.

The fourth is a tool that its README calls a full chain exploiter, with a target list and search queries for finding sites. Its three writer entries are placeholders with invented paths. Against a real site, its find-the-writer stage has nothing real to find. We did not run it.

X: from 12 to 23 October we pulled 169 posts, and 106 mention Drupal or the CVE. Most repeat the advisory or the news. A few accounts claimed attacks or public exploit code with no evidence. One named post adds something real. Fortbridge wrote on 19 October:

"no real writer confirmed yet. The search continues." @FORTBRIDGE, 19 October 2026: FORTBRIDGE post on X

Fortbridge says it rebuilt the exploit on Drupal 11.4.9 and 11.4.10 pairs, and that every variant fails on the patched site.

Dark web monitoring through THANOS, 12 to 23 October: 7 posts carry the CVE id, 6 on Telegram channels and 1 on a forum. They are news reposts and links. On 21 October a Telegram bot that feeds exploit repositories listed the target tool described above as a proof of concept. This is our own reading of aggregate counts, and it is not verified.

Our conclusion: the risk is real but narrow today. Treat it as a patch now flaw, because the missing piece, a writer module, could be named any day.

The advisory lists four ranges of Drupal core as affected:

• 8.9.0 up to but not including 10.6.19.
• 11.0.0 up to but not including 11.3.19.
• 11.4.0 up to but not including 11.4.10.
• 12.0.0-alpha1 up to but not including 12.0.0-beta2.

Fixed releases are 10.6.19, 11.3.19 and 11.4.10, and 12.0.0-beta2 contains the fix. Drupal 8 and 9 are end of life.

Branches With No Fix

Drupal 11.2.x and below, and 10.5.x and below, are end of life and get no fix. That covers 8.9 to 10.5 and 11.0 to 11.2. A site there must move to 10.6, 11.3 or 11.4 first.

The drupal.org usage table for the week starting 4 October lists 531,499 reporting sites. Adding its columns for 8.9.x to 10.5.x and for 11.0.x to 11.2.x gives 151,442 sites, or 28.5%. The sum is ours. Drupal.org counts only sites that report. The table cannot show patch level, so we cannot say how many sites on 10.6, 11.3 or 11.4 already run a fixed release.

Time is short on the supported branches too. Drupal's release schedule ends security support for 11.3.x and 10.6.x in the week of 7 December 2026, when Drupal 12.0.0 and 11.5.0 are due. Drupal 10 reaches end of life on 9 December 2026.

Entity List (CVE-2026-108099)

Entity List is the one module known to have used the vulnerable pattern. Advisory SA-CONTRIB-2026-218 of 14 October rates it Critical, 19 out of 25, with remote code execution. It carries CVE-2026-108099 and the same wording: not directly exploitable with the module alone, and at least one known path with no login. Entity List 3.0.10 fixes it, and versions below 3.0.10 are affected. Its project page says 191 sites report using it.

Related Advisories

The same core release fixed two cross-site scripting flaws, SA-CORE-2026-015 and SA-CORE-2026-016, both rated Moderately critical. On 21 October Drupal also published SA-CONTRIB-2026-253 for the Monster Menus module, rated Critical, 16 out of 25. It needs the RSS Page submodule and a role that may create RSS Feed content.

This Is Not PHP2Shell

The PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, are a separate bug in the PHP engine itself. A Drupal site needs both the PHP update and the Drupal update. Our PHP2Shell analysis lists the fixed PHP versions, and the first 60 hours of PHP2Shell shows how the wave moved.