Threat reportVulnerabilityTL-2026-3616
Drupal Core Field UI Critical Flaw (CVE-2026-108097, SA-CORE-2026-014) With Unauthenticated RCE Path via Contributed Modules
Drupal Core Field UI Critical Flaw (CVE-2026-108097 (TL-2026-3616), also tracked as SA-CORE-2026-014, is a critical-severity software vulnerability, first published 2026-10-15. It has no confirmed attribution, affects Drupal Drupal Core (Field UI), references 4 CVEs (CVE-2026-108097, CVE-2026-108099, CVE-2026-108515), maps to 5 MITRE ATT&CK techniques (T1059, T1190, T1505.003), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3616
- Threat ID
- TL-2026-3616
- Also known as
- SA-CORE-2026-014, PSA-2026-10-12
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, education, news - media, nonprofit, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Drupal Core Field UI Critical Flaw (CVE-2026-108097
Malware and tooling: PHP, core
How Drupal Core Field UI Critical Flaw (CVE-2026-108097 works
Drupal patched a critical Field UI vulnerability (SA-CORE-2026-014, CVE-2026-108097) that executes arbitrary PHP callables supplied in table row properties. Core alone cannot reach the flaw, but contributed modules expose exploit paths, at least one of which needs no authentication. No public PoC and no in-the-wild exploitation were reported at publication.
SA-CORE-2026-014 (CVE-2026-108097) affects the Field UI module in Drupal core, which powers the administrative field-management pages. According to the reporting, the vulnerable code ran whatever PHP callable each table row carried in its #region_callback property through call_user_func_array, with no check on what that callable was. If an attacker can influence the render array that reaches FieldUiTable, this becomes arbitrary PHP function invocation, i.e. remote code execution.
Drupal rates the issue Critical at 19/25 on its own security-risk scale (not CVSS). Core on its own does not expose a path to attacker-controlled input, but the advisory states that multiple serious exploit paths exist through contributed modules, and at least one known path requires no authentication. The related advisory SA-CONTRIB-2026-218 (Entity List module, CVE-2026-108099, fixed in 3.0.10) is a critical RCE in a contributed module with an unauthenticated exploit path and was released alongside the core fix. The pre-announcement PSA-2026-10-12 warned that exploits might be developed within hours or days of release.
The fix, shipped in Drupal 11.4.10, 11.3.19, 10.6.19 and 12.0.0-beta2, removes the unsafe callback execution and instead reads each row's region from the row's own region value (FieldUiTable::tablePreRender uses $row['region']['#value'] with a fallback to a valid region). Drupal 8 and 9 and earlier unsupported 10.x/11.x branches are end-of-life and receive no fix. Drupal reported that 28.5% of reporting sites (151,442 of 531,499) ran affected, unfixed versions during the week of October 4, 2026. Mitigations are to patch, to uninstall the field_ui module as a temporary measure, or to rely on Drupal Steward WAF rules, which cover only some known vectors. Companion advisories released the same day: SA-CORE-2026-015 (Link XSS, CVE-2026-108515) and SA-CORE-2026-016 (Navigation XSS, CVE-2026-108514). The flaw was reported by Drew Webber (Drupal Security Team) and Octavio Galland. No IOCs, exploit code or attributed threat actor were published.
MITRE ATT&CK techniques used in TL-2026-3616
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Server Software Component: Web Shell
Resource Development
T1588.005 Obtain Capabilities: Exploits
Reconnaissance
Affected products and versions in Drupal Core Field UI Critical Flaw (CVE-2026-108097
Remediation for Drupal Core Field UI Critical Flaw (CVE-2026-108097
Patches
- Drupal 11.4.10
- Drupal 11.3.19
- Drupal 10.6.19
- Drupal 12.0.0-beta2
- Entity List 3.0.10
Immediate actions
- Upgrade Drupal core to 11.4.10, 11.3.19, 10.6.19 or 12.0.0-beta2
- Update the Entity List contributed module to 3.0.10 (SA-CONTRIB-2026-218)
- Inventory all contributed modules that process attacker-influenced form or render arrays and review their advisories
Workarounds
- Uninstall the field_ui module (disables admin field management pages)
- Use Drupal Steward WAF rules (covers some known vectors, not all possible exploits)
Longer-term hardening
- Migrate off end-of-life Drupal 8, 9 and unsupported 10.x/11.x branches
- Subscribe to Drupal security announcements and pre-announcement PSAs to schedule patch windows
- Monitor web server and PHP logs for unexpected callable names in requests to Field UI and contributed form endpoints
CVEs associated with Drupal Core Field UI Critical Flaw (CVE-2026-108097
CVE-2026-108097, CVE-2026-108099, CVE-2026-108515, CVE-2026-108514
Timeline of Drupal Core Field UI Critical Flaw (CVE-2026-108097
- Week of October 4: Drupal reports 28.5% of reporting sites (151,442 of 531,499) running affected, unfixed versions.
- Drupal publishes PSA-2026-10-12 announcing a critical core security release window and warning exploits might be developed within hours or days.
- Companion advisories SA-CORE-2026-015 (Link XSS, CVE-2026-108515) and SA-CORE-2026-016 (Navigation XSS, CVE-2026-108514) published.
- SA-CONTRIB-2026-218 (Entity List 3.0.10, CVE-2026-108099) released: critical RCE with an unauthenticated exploit path via contributed modules.
- SA-CORE-2026-014 (CVE-2026-108097) released with fixes in Drupal 11.4.10, 11.3.19, 10.6.19 and 12.0.0-beta2 (window 16:00-21:00 UTC).
- The Hacker News reports the flaw; no public exploit code and no active attacks reported.
Sources cited for Drupal Core Field UI Critical Flaw (CVE-2026-108097
- Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
- Drupal Security Advisory SA-CORE-2026-014
- Drupal PSA-2026-10-12 Core Security Release Pre-announcement
- Drupal Security Advisory SA-CONTRIB-2026-218 (Entity List)
- Fixed code: FieldUiTable.php in Drupal 11.4.10
- Drupal Security Advisory SA-CORE-2026-015 (Link XSS)
- Drupal Security Advisory SA-CORE-2026-016 (Navigation XSS)
Detection coverage for TL-2026-3616
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3616 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.