Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Summary: Drupal shipped fixes on October 14 in versions 11.4.10, 11.3.19, and 10.6.19 for a critical Field UI flaw, CVE-2026-108097, rated 19 out of 25 on Drupal's risk scale, which cannot be reached through core alone but has exploit paths through contributed modules, at least one of which needs no login. In the week starting October 4, 151,442 of 531,499 reporting sites (28.5%) were on an affected branch that received no fix, and the advisory notes the same releases also patch two moderately critical cross-site scripting flaws in the Link and Navigation modules.
Key Takeaway: Roughly 151,000 sites were sitting on branches with no fix, and Drupal pre-announced the release on October 12 warning that exploits might be developed within hours or days - a timeline it has already seen, with exploit attempts within two days of its May SQL injection advisory.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-108097CVE-2026-108099
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026