Drupal Field UI Module Vulnerability Allows Unauthenticated RCE via Contributed Modules

Drupal has patched a critical vulnerability in its Field UI module that allows unauthenticated remote code execution (RCE) through contributed modules. The fix was released on October 14, 2026, in versions 11.4.10, 11.3.19, and 10.6.19, with exploit paths requiring third-party modules.

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.

An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.

Read original article