|
Information Security Advisory
A recently disclosed vulnerability (CVE-2026-108097) affects Drupal Core and may allow remote attackers to execute arbitrary code on vulnerable servers.
Severity level:
Critical
Description:
CVE-2026-108097 is a critical remote code execution vulnerability in the Field UI module (field_ui) included with Drupal Core. The vulnerability is not directly exploitable through Drupal Core alone; however, contributed modules and custom code may expose the affected functionality.
Affected Versions:
The vulnerability affects the following Drupal Core versions:
- Drupal 8.9.0 through 10.6.18
- Drupal 11.0.0 through 11.3.18
- Drupal 12.0.0-alpha1 through 12.0.0-beta1
Impact:
Successful exploitation may allow attackers to execute arbitrary code on Drupal servers.
Resolution:
Upgrade affected Drupal installation immediately to the following fixed versions or later.
- Drupal 10.6.19 or later
- Drupal 11.3.19 or later
- Drupal 11.4.10 or later
- Drupal 12.0.0-beta2 or later
Reference:
https://www.drupal.org/sa-core-2026-014
https://nvd.nist.gov/vuln/detail/cve-2026-108097
https://www.tenable.com/cve/CVE-2026-108097/plugins
UIT Information Security
Contact
IT Client Services at askIT@yorku.ca or 416 736 5800
|
