Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication
Brief
Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in.
Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026.
The official security advisory, SA-CORE-2026-014, assigns the issue a risk score of 19 out of 25 under Drupal’s rating system. Successful exploitation could expose all private website data and allow attackers to change or delete information. The score is not a CVSS rating.
The most important detail is that Drupal core alone does not provide a direct path to exploit the flaw. However, the security team confirmed that several serious attack paths exist when contributed modules are present. These are additional modules used to extend a website’s features beyond its core functions.