Critical RCE Vulnerability Discovered in Drupal Field UI Module
Drupal core has released a critical security advisory (SA-CORE-2026-014) for a remote code execution vulnerability in the Field UI module, with multiple exploit paths, some unauthenticated.
Drupal core has issued a critical security advisory, SA-CORE-2026-014, detailing a remote code execution (RCE) vulnerability within its Field UI module. This vulnerability, rated as critical with a CVSS score of 19/25, poses a significant threat to Drupal installations.
The vulnerability is not directly exploitable using Drupal core alone. However, the advisory highlights that multiple serious exploit paths exist when the Field UI module is combined with certain contributed modules. Alarmingly, at least one known exploit path does not require any authentication, meaning unauthenticated attackers could potentially leverage this flaw. Furthermore, custom code developed for Drupal sites could also inadvertently expose the vulnerable functionality, increasing the attack surface.
Affected versions span a wide range of Drupal releases, including Drupal 8.9.0 up to 12.0.0-beta2. Specifically, versions 8.9.0 through 10.6.18, 11.0.0 through 11.3.18, and 11.4.0 through 11.4.9 are vulnerable. Drupal 8 and 9 have reached their end-of-life and are no longer supported, while specific earlier versions of Drupal 10 and 11 also fall outside the scope of security coverage.
To mitigate this critical vulnerability, Drupal recommends uninstalling the core Field UI module (field_ui). This action will provide protection while site administrators prepare to update their systems. Drupal Steward protection is in place, offering some defense against known attack vectors, but it is not a comprehensive solution against all potential exploits.
Drupal has released updated versions to address the vulnerability. Users running Drupal 11.4.x should update to version 11.4.10. Those on Drupal 11.3.x should update to 11.3.19. For Drupal 10 users, updating to version 10.6.19 is recommended. It is important to note that older versions of Drupal 10 and 11, as well as end-of-life versions of Drupal 8 and 9, do not receive security updates.
The discovery and reporting of this vulnerability are credited to Drew Webber (mcdruid) of the Drupal Security Team, with Octavio Galland (ogalland-tob) also contributing. The fix was implemented by a team including catch (catch), Lee Rowlands (larowlan), Dave Long (longwave), Drew Webber (mcdruid), and Jess (xjm), all from the Drupal Security Team. The coordinated disclosure process involved several key individuals from the Drupal Security Team.
This critical RCE vulnerability underscores the ongoing security challenges within complex web content management systems. The reliance on contributed modules and custom code can introduce unforeseen attack vectors, making diligent security auditing and prompt patching essential for maintaining the integrity and security of Drupal websites.