Remote code execution affecting Drupal Core
A vulnerability affecting Drupal Core would allow a malicious actor to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
Drupal is an open source content management system (CMS) widely used for creating and managing websites and online applications. This product is affected by a vulnerability labeled CVE-2026-108097 resulting from insufficient validation of a parameter (#region_callback) in the Field UI module of Drupal Core. Exploitation of this vulnerability would allow a malicious actor to execute arbitrary code remotely on the affected server, particularly in the presence of certain additional modules or custom code. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Data integrity breach;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- Drupal 8.9.0 to 10.6.x before 10.6.19;
- Drupal 11.0.x to 11.3.x before 11.3.19;
- Drupal 11.4.x before 11.4.10;
- Drupal 12.0.0-alpha1 to beta1;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Drupal to versions 10.6.19, 11.3.19, 11.4.10 or later;
- Uninstall Field UI module (field_ui) until patches are applied;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.