# Drupal Core Field UI Critical Flaw (CVE-2026-108097, SA-CORE-2026-014) With Unauthenticated RCE Path via Contributed Modules

> Drupal patched a critical Field UI vulnerability (SA-CORE-2026-014, CVE-2026-108097) that executes arbitrary PHP callables supplied in table row properties. Core alone cannot reach the flaw, but contributed modules expose exploit paths, at least one of which needs no authentication. No public PoC and no in-the-wild exploitation were reported at publication.

- **Published:** 2026-10-15T12:28:27Z
- **Last reviewed:** 2026-10-15T12:28:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3616
- **ID:** TL-2026-3616
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-108097, CVE-2026-108099, CVE-2026-108515, CVE-2026-108514

## Description

SA-CORE-2026-014 (CVE-2026-108097) affects the Field UI module in Drupal core, which powers the administrative field-management pages. According to the reporting, the vulnerable code ran whatever PHP callable each table row carried in its #region_callback property through call_user_func_array, with no check on what that callable was. If an attacker can influence the render array that reaches FieldUiTable, this becomes arbitrary PHP function invocation, i.e. remote code execution.

Drupal rates the issue Critical at 19/25 on its own security-risk scale (not CVSS). Core on its own does not expose a path to attacker-controlled input, but the advisory states that multiple serious exploit paths exist through contributed modules, and at least one known path requires no authentication. The related advisory SA-CONTRIB-2026-218 (Entity List module, CVE-2026-108099, fixed in 3.0.10) is a critical RCE in a contributed module with an unauthenticated exploit path and was released alongside the core fix. The pre-announcement PSA-2026-10-12 warned that exploits might be developed within hours or days of release.

The fix, shipped in Drupal 11.4.10, 11.3.19, 10.6.19 and 12.0.0-beta2, removes the unsafe callback execution and instead reads each row's region from the row's own region value (FieldUiTable::tablePreRender uses $row['region']['#value'] with a fallback to a valid region). Drupal 8 and 9 and earlier unsupported 10.x/11.x branches are end-of-life and receive no fix. Drupal reported that 28.5% of reporting sites (151,442 of 531,499) ran affected, unfixed versions during the week of October 4, 2026. Mitigations are to patch, to uninstall the field_ui module as a temporary measure, or to rely on Drupal Steward WAF rules, which cover only some known vectors. Companion advisories released the same day: SA-CORE-2026-015 (Link XSS, CVE-2026-108515) and SA-CORE-2026-016 (Navigation XSS, CVE-2026-108514). The flaw was reported by Drew Webber (Drupal Security Team) and Octavio Galland. No IOCs, exploit code or attributed threat actor were published.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.005 Obtain Capabilities: Exploits

## Sources

- [Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules](https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html)
- [Drupal Security Advisory SA-CORE-2026-014](https://www.drupal.org/sa-core-2026-014)
- [Drupal PSA-2026-10-12 Core Security Release Pre-announcement](https://www.drupal.org/psa-2026-10-12)
- [Drupal Security Advisory SA-CONTRIB-2026-218 (Entity List)](https://www.drupal.org/sa-contrib-2026-218)
- [Fixed code: FieldUiTable.php in Drupal 11.4.10](https://raw.githubusercontent.com/drupal/drupal/11.4.10/core/modules/field_ui/src/Element/FieldUiTable.php)
- [Drupal Security Advisory SA-CORE-2026-015 (Link XSS)](https://www.drupal.org/sa-core-2026-015)
- [Drupal Security Advisory SA-CORE-2026-016 (Navigation XSS)](https://www.drupal.org/sa-core-2026-016)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3616