The October 14 Drupal core security release fixes a remote code execution flaw in Field UI, the core module site builders use to manage fields. The Drupal Security Team rated it Critical, 19 out of 25, in SA-CORE-2026-014. The fixed versions are Drupal 11.4.10, 11.3.19 and 10.6.19.
The team announced the release two days ahead in PSA-2026-10-12 and published the advisory on the afternoon of October 14. The same releases fix two Moderately critical cross-site scripting flaws. This post covers what the advisory says, the stopgap if you cannot update today, and the update steps. Facts here are as of the evening of October 14, 2026. It is written for agencies and IT leads at associations, nonprofits and universities.
The short version: update core to 11.4.10, 11.3.19 or 10.6.19 today, test the forms your members use, and confirm with your host who applies core updates. If you cannot update today, uninstall Field UI until you can. If your site runs Drupal 10, this is one of the last core security releases Drupal 10 will get. After December 9, 2026, there are none.
What SA-CORE-2026-014 says about the Drupal core security release
The advisory is short. Here is what it confirms:
- Type. Remote code execution, CVE-2026-108097. In the worst case, an attacker could run their own code on your server.
- Where. The Field UI module (
field_ui) in Drupal core. - Core alone is not enough. The advisory says “The vulnerability is not directly exploitable with core alone,” and that “multiple serious exploit paths exist with contributed modules.”
- No login needed on some paths. “At least one known exploit path does not require authentication.”
- Custom code counts too. “Custom code may also expose the vulnerable functionality.”
- No public exploit yet. The rating is theoretical as of publication.
The advisory does not name the contributed modules. Most association and university sites run dozens of them, so do not assume your site is safe because core alone is not exploitable. Treat every site with Field UI installed as in scope.
How the score changed from the PSA
Drupal scores each advisory with a public formula on its risk levels page. A score of 15 to 19 is Critical. A score of 20 or more is Highly critical. The total stayed at 19, but two parts of the vector changed between the PSA and the advisory.
| Factor | PSA, October 12 | Advisory, October 14 | Plain meaning |
|---|---|---|---|
| Access complexity | Complex | Basic | Easier to exploit than first stated |
| Target distribution | All | Default | Default or common setups are exposed, and a setting change can block it |
| Authentication | None | None | Anyone could attempt it |
| Data impact | All | All | All non-public data could be read, changed or deleted |
The "setting change" here is the Field UI mitigation below. The easier access complexity is the change to note. It is one more reason to update today rather than at the next maintenance window.
Fixed versions for each Drupal branch
The Drupal core security release covers three supported branches. Older branches get nothing.
| Your version | Fixed in | Security coverage | What to do |
|---|---|---|---|
| Drupal 11.4.x | 11.4.10 | Until June 2027 | Update today |
| Drupal 11.3.x | 11.3.19 | Until December 2026 | Update today, then plan the move to 11.4 |
| Drupal 10.6.x | 10.6.19 | Until December 9, 2026 | Update today, then finish the Drupal 11 upgrade |
| 11.2.x or older, 10.5.x or older, Drupal 9 or 8 | No fix | End-of-life | Uninstall Field UI now, then move to a supported branch |
The coverage dates come from the 11.4.10 release notes and the matching 11.3.19 and 10.6.19 notes. The two cross-site scripting fixes, SA-CORE-2026-015 in the Link module and SA-CORE-2026-016 in the Navigation module, ship in the same releases.
Drupal 12 test sites are affected from 12.0.0-alpha1 up to, but not including, 12.0.0-beta2. The advisory names no fixed Drupal 12 release, and we could not confirm a beta2 release page. A beta should not run a live site. Our post on the Drupal 12 beta arriving late covers where that release stands.
Step 1: Find your Drupal version
You need the exact version before you can plan the Drupal core security release. Go to Reports, then Status report. The version is near the top. From the command line, run this in the project folder:
composer show drupal/core | grep versionsWrite the number down for every site you look after. Agencies with many client sites should build that list first and sort it into the rows of the table above. Sites on end-of-life branches go to the top, since they need the most work and have no fix.
If a vendor runs your site, ask for the version in writing. A screenshot of the Status report settles it.
Step 2: If you cannot update today, uninstall Field UI
The advisory says the flaw "can be mitigated by uninstalling the core Field UI module (field_ui)" while sites are updated. Field UI is the admin screen for adding and editing fields on content types. Editors do not use it day to day. Site builders do.
With Drush, preview the change, then run it:
drush pm:uninstall --simulate field_ui
drush pmu field_uiThe first line shows what would be uninstalled without changing anything. The second runs the uninstall. pmu is the short alias for pm:uninstall in the Drush documentation. Without Drush, use Extend, then Uninstall, in the admin screens.
This is a stopgap and does not replace the Drupal core security release. It is also the only protection the advisory offers for sites on end-of-life branches. Keep the update on today’s list either way.
Step 3: Update Drupal core with Composer
Most current Drupal sites use Composer and the drupal/core-recommended package. Drupal’s guide to updating Drupal core via Composer gives these steps. Take a database backup first (drush sql:dump), and run them on a staging copy before production.
composer outdated "drupal/*"
drush state:set system.maintenance_mode 1
drush cache:rebuild
composer update "drupal/core-*" --with-all-dependencies
drush updatedb
drush cache:rebuild
drush state:set system.maintenance_mode 0
drush cache:rebuildThe update command pulls the Drupal core security release and the packages it depends on. Then drush updatedb runs any database updates, and the cache rebuild clears old code.
Commit the updated composer.lock file and deploy it the way you normally do. Then check the Status report. It should read 11.4.10, 11.3.19 or 10.6.19. If a Composer constraint held core back, the version will not have moved. That is the most common way an update fails without anyone noticing.
The advisory notes that release packaging may still be in progress when it posts. If a release is missing, it says to wait 30 to 45 minutes and check again.
Step 4: Check what your host does for you
Hosting changes the steps for a Drupal core security release, so confirm the details with your host today.
Drupal Steward. Drupal Steward is a web application firewall offered by the Drupal Security Team. The advisory says Steward sites "are already protected from some known attack vectors," and that the protection will not cover all possible exploits. Steward’s own page says it "isn’t a substitute for patching." It lists Acquia, Pantheon, Ironstar and Skpr as hosts that run it for their customers.
Who applies the update. On many platforms, the host makes the update available and you apply it. Pantheon’s core updates documentation says security updates appear within 24 hours of the upstream release, as one-click updates for Integrated Composer sites. That page was last reviewed in 2022, so confirm the current process.
On any host, ask one question: who applies Drupal core updates on our plan, us or you? Our Pantheon and Acquia comparison covers how the two big Drupal hosts differ.
Step 5: Test the forms and pages members use
A Drupal core security release can break things that look fine on the home page. Test the paths that bring in members, money and registrations:
- Log in and log out, including password reset and any single sign-on.
- Join, renew and donate, through to the payment confirmation.
- Event registration and any forms that send data to your AMS or CRM.
- Links and menus, since the Link and Navigation modules changed too.
- Editor tasks: create, edit and publish a page.
Then check Reports, then Recent log messages, for new errors. If you uninstalled Field UI as a stopgap, reinstall it once the update is live and your site builders need it.
This is also a good time to clear waiting module updates. Last week brought 26 Drupal module advisories in one day, and the Webform advisories came two weeks before that.
Why this Drupal core security release matters more on Drupal 10
Drupal’s release schedule says "Drupal 10.6.0 is the last minor release of Drupal 10." It also says "Drupal 10 will reach end of life on December 9, 2026." After that, no new Drupal 10 releases will be made.
This week, a Drupal 10.6 site can close a remote code execution flaw with one update to 10.6.19. Sites on 10.5 or older already had no fix this time. After December 9, every Drupal 10 site will be in that position.
The 11.3 branch has a deadline too. Its coverage also ends in December 2026, so 11.3 sites should plan the move to 11.4, which is covered until June 2027.
If you need to make the case to your board or executive director, our one-page Drupal 10 brief for boards is written for that. For the technical path, see our Drupal 10 to 11 upgrade guide.
Frequently Asked Questions
What did the October 14 Drupal core security release fix?
A Critical remote code execution flaw in the Field UI module, SA-CORE-2026-014, rated 19 out of 25. The same releases fix two Moderately critical cross-site scripting flaws, SA-CORE-2026-015 and SA-CORE-2026-016.
Which versions fix it?
Drupal 11.4.10, 11.3.19 and 10.6.19. Drupal 11.2.x and older, 10.5.x and older, and Drupal 9 and 8 are end-of-life and get no fix.
Is my site exploitable if it only runs Drupal core?
The advisory says the flaw is not directly exploitable with core alone. Contributed modules create exploit paths, and custom code may too. Almost every real site runs contributed modules, so update anyway.
Has anyone been attacked through it?
The advisory rates exploitation as theoretical, meaning no public exploit code was known at publication. The PSA warned that exploits might be developed within hours or days, so do not wait.
What if I cannot update today?
Uninstall the core Field UI module with drush pmu field_ui, or under Extend, then Uninstall. The advisory names this as the mitigation while sites are updated. Reinstall it after the update if your site builders need it.
How do I update Drupal core with Composer?
Run composer update "drupal/core-*" --with-all-dependencies, then drush updatedb and drush cache:rebuild. Test on staging first, take a database backup, and confirm the new version on the Status report.
Does Drupal Steward protect my site?
Partly. The advisory says Steward blocks some known attack paths but will not cover all possible exploits. Acquia, Pantheon, Ironstar and Skpr run Steward for their customers. You still need to apply the Drupal core security release.
We are on Drupal 10.5. What should we do?
Drupal 10.5 is end-of-life and gets no fix. Uninstall Field UI now, move to 10.6.19 as soon as you can, then finish the Drupal 11 upgrade before December 9, 2026.
What happens to Drupal 10 sites after December 9, 2026?
Drupal 10 gets no new releases after that date, including security releases. A critical core flaw found after December 9 will have no Drupal 10 fix to install.
