Drupal Core: Five Vulnerabilities Including Critical RCE Disclosed Together
Drupal core saw a coordinated disclosure of five vulnerabilities on October 15, 2026, including a critical unauthenticated RCE flaw in the Field UI module.
Key findings
- Drupal core patched five vulnerabilities on October 15, 2026, including critical RCE and XSS flaws.
- CVE-2026-108097 allows unauthenticated RCE via contributed modules affecting Field UI.
- Two XSS vulnerabilities (CVE-2026-108515, CVE-2026-108514) impact Link and Navigation modules.
- Patches are available in Drupal 10.6.19, 11.3.19, and 11.4.10.
- Uninstalling Field UI module is a mitigation for CVE-2026-108097.
On October 15, 2026, a batch of five security vulnerabilities was disclosed for Drupal core, with the Drupal Security Team releasing advisories for these issues. The disclosures include critical vulnerabilities, with one allowing for unauthenticated remote code execution, highlighting a significant risk to Drupal-powered websites.
Several of the disclosed vulnerabilities stem from flaws within Drupal's Field UI module. CVE-2026-108097, rated as critical, is a remote code execution vulnerability within this module. While not directly exploitable through Drupal core alone, multiple exploit paths exist through contributed modules, and at least one path requires no authentication. This vulnerability affects versions prior to 10.6.19, 11.3.19, and 11.4.10.
Further compounding the risk, two cross-site scripting (XSS) vulnerabilities were also detailed. CVE-2026-108515, a moderately critical XSS flaw, resides in the Link module. It arises from insufficient sanitization of certain markup in specific circumstances, potentially allowing attackers to inject malicious scripts. This vulnerability impacts versions prior to 10.6.19, 11.3.19, and 11.4.10. Similarly, CVE-2026-108514, another moderately critical XSS vulnerability, is found in the Navigation module due to inadequate sanitization of specific attributes. Exploiting this requires a user role with permissions to enter HTML tags with specific data attributes or the administer menu permission. Affected versions are also prior to 10.6.19, 11.3.19, and 11.4.10.
The batch also includes two other advisories, CVE-2026-108099 and CVE-2026-110738, though specific details on their nature and impact are less elaborated in the provided summaries, beyond being listed in Drupal security advisories.
Drupal addressed these vulnerabilities by releasing patched versions: Drupal 10.6.19, 11.3.19, and 11.4.10. Users are strongly advised to update to these versions to mitigate the risks associated with these critical and moderately critical flaws. For those unable to update immediately, uninstalling the Field UI module was suggested as a mitigation for CVE-2026-108097, though this would disable field administration functionality.
This coordinated disclosure event underscores the importance of timely patching for Drupal core, especially given the presence of unauthenticated remote code execution and cross-site scripting vulnerabilities. Website administrators should prioritize applying the available security updates to protect their sites from potential compromise. The Drupal Security Team's advisories provide the most comprehensive details for each specific vulnerability.