Drupal Fixes a Critical Core Flaw: Update to 11.4.10 Now

Drupal shipped the fix for the critical core flaw it pre-announced two days earlier on October 14, 2026. The advisory, SA-CORE-2026-014, covers remote code execution through core's Field UI module. It affects Drupal 10 and 11, and the fix is to install 11.4.10, 11.3.19 or 10.6.19.

What we know

  • The advisory: SA-CORE-2026-014, published by the Drupal Security Team on October 14 at 16:10 UTC. It is rated "Critical," 19 out of 25, for remote code execution, and tracked as CVE-2026-108097.
  • Where the flaw is: in Field UI (`field_ui`), the core module used to manage fields from the admin interface.
  • When it's dangerous: per the advisory, core on its own isn't directly exploitable. Several contributed modules open serious paths, though, and at least one requires no login. A site's custom code can expose it too.
  • Affected versions: 8.9.0 up to before 10.6.19; 11.0.0 up to before 11.3.19; 11.4.0 up to before 11.4.10; and Drupal 12 pre-releases before 12.0.0-beta2.
  • Fixed versions: 11.4.10, 11.3.19 and 10.6.19, released the same day. They also fix two "moderately critical" cross-site scripting advisories: SA-CORE-2026-015 in the Link module and SA-CORE-2026-016 in the Navigation module. According to Drupal, both need an account with permissions on the site and only uncommon configurations are exploitable.
  • Unsupported: Drupal 11.2.x and earlier, and 10.5.x and earlier, no longer get security fixes. Neither do Drupal 8 or 9.
  • Until you update: the advisory says uninstalling Field UI provides protection while sites are updated. Drupal Steward offers partial protection that doesn't cover every path.
  • Is it being exploited? The advisory doesn't report attacks. Its scoring marks exploitation as "theoretical," meaning no public exploit code so far.
  • Drupal 10: the 10.6.19 release page says the 10.6 branch gets security coverage until Drupal 10 reaches end of life in December 2026.

What changes and what doesn't

The October 12 pre-announcement already flagged how serious this was. What's new is that the patch is out and the flawed module is known. Anyone can now compare the old and new code, so delays favor attackers.

Drupal 7 isn't affected, and neither are sites built on other platforms such as WordPress.

How to tell if this affects you

  1. Check your version. In the Drupal admin, go to Reports → Status report (`/admin/reports/status`). It also shows under Reports → Available updates.
  2. Pick the release for your branch:

- 11.4.x → 11.4.10

- 11.3.x → 11.3.19

- 10.6.x → 10.6.19

- 11.2 or older, 10.5 or older, Drupal 8 or 9 → no patch; you need to move to a supported branch.

  1. Update today, after a backup. If your site is managed with Composer, each release page on drupal.org gives the exact command. Then run database updates and clear the cache.
  2. If you can't update today, check under Extend (`/admin/modules`) whether Field UI is enabled. Uninstalling it is the stopgap the advisory gives. Field UI is only the screen for managing fields: removing it doesn't delete the fields in your content, but you can't edit them from the admin until you reinstall it.
  3. If a developer or your host maintains the site, ask two questions today: which Drupal version it runs, and when it will be on 11.4.10, 11.3.19 or 10.6.19.
  4. If you're on Drupal 10, start planning the move to Drupal 11 now: the branch loses support in December 2026.

Related: Drupal Critical Core Patch on October 14: What to Do

Sources

Updates: if Drupal reports attacks or ships another release, it will be added here with a link.