SA-CORE-2026-014: Critical severity Drupal Drupal vulnerability
A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. The vulnerability can be mitigated by uninstalling the core Field UI module (fieldui), which will provide protection while sites are updated. Drupal Steward protection: This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.10Fixed in 11.3.19Fixed in 10.6.19 - Remove
Remove
Drupal core Field UI module (field_ui)from your environment.Uninstall the core Field UI module (field_ui) to mitigate the vulnerability while sites are updated.
Event History
Frequently Asked Questions
Which sites are most exposed to exploitation?
Sites using the core Field UI module together with affected contributed modules are exposed to known serious exploit paths. Custom code can also expose the vulnerable functionality, and at least one known path is unauthenticated.
Is Drupal core alone directly exploitable?
No. The issue is not directly exploitable with core alone, but contributed modules or custom code can create exploitable paths.
What can be done if an update cannot be applied immediately?
Uninstall the core Field UI module (field_ui) to mitigate the issue while updates are being applied. This provides protection while the site is updated.
Does Drupal Steward fully address the risk?
No. Drupal Steward protects against some known attack vectors, but it does not cover all possible exploits; sites should still upgrade promptly.