News Vulnerabilities & Zero-Days
Drupal fixes critical Field UI RCE flaw reachable without login through contributed modules
Drupal released fixes on 14 October 2026 for CVE-2026-108097, a critical remote code execution flaw in core's Field UI module. Core alone does not expose it, but at least one known exploit path through a contributed module requires no authentication.
Jaydeep Bhatt