Free checker and checklist

Drupal SA-CORE-2026-014: is your site affected, and what to do

Drupal's security team published a critical advisory on October 14, 2026 for a remote code execution flaw in the core Field UI module (CVE-2026-108097). Type your Drupal core version below. The check runs in your browser, nothing is sent anywhere.

What the advisory says. The flaw is not directly exploitable with core alone, but serious exploit paths exist through contributed modules, and at least one known path needs no login. Custom code may also expose it. Drupal's advisory rated exploit status as theoretical at publication, and The Hacker News reported on October 15 that no public exploit code had surfaced and no attacks were described. That can change, so patch. Sources: drupal.org, Tenable, The Hacker News.

1. Check your version

Drupal core version (for example 10.6.18 or 11.4.9)

Find your version in Reports, Status report in the admin, or run drush status, or composer show drupal/core.

2. Fixed releases

Your branch	Update to
Drupal 11.4.x	11.4.10
Drupal 11.3.x	11.3.19
Drupal 10.6.x	10.6.19
Drupal 12.0.0 pre releases	12.0.0-beta2 (not for production, per The Hacker News)
11.2.x and below, 10.5.x and below, Drupal 8 and 9	No fix. End of life per the advisory. Move to a supported branch.

Affected, per the advisory: 8.9.0 up to before 10.6.19, 11.0.0 up to before 11.3.19, 11.4.0 up to before 11.4.10, and 12.0.0-alpha1 up to before 12.0.0-beta2. The Hacker News reports that 11.3.x and 10.6.x lose security coverage in December 2026.

3. If you cannot update today

The advisory says uninstalling the core Field UI module (field_ui) provides protection while sites are updated. The Hacker News notes the admin pages for managing fields and their display are unavailable while it is uninstalled, and that the Standard install profile installs Field UI. Drupal Steward, which Acquia, Pantheon, Ironstar and Skpr run for customers, already blocks some known attack vectors but not all, so those sites should still update.

drush pm:uninstall field_ui
drush cache:rebuild

Back up first. Field data is not what this removes, but test on a copy if you can.

4. Quick checklist

Update steps follow Drupal's guide: Updating Drupal core via Composer.

Running several sites?

What is at stake. Drupal rates this critical, and says at least one known exploit path needs no login. The Hacker News reports 28.5% of sites reporting a core version to drupal.org were on an affected branch with no fix. For scale, IBM's 2025 Cost of a Data Breach report puts the global average cost of a breach at $4.44 million and the US average at $10.22 million. That is an average across organizations of all sizes, not a prediction for your site (IBM, The Hacker News).

Pro, $249 one time

Drupal patch kit Pro

Everything in Team
Audit workbook (.xlsx) with formulas: per site status (open, mitigated, patched, verified, end of life), verification matrix, client comms log, summary counts and percent verified
One free update

Get Pro, $249

Team, $99 one time

Drupal patch kit Team

Everything in Starter
Four client notification templates for agencies: heads up, patched, mitigated, end of life
Post patch verification checklist
Incident log template
One free update

Get Team, $99

Starter, $29 one time

Drupal patch kit Starter

Multi site inventory tracker with CSV export
Per install runbook: Composer, Drush, manual, mitigation, rollback

Get Starter, $29

Team and Pro include one free update: if the source changes materially, we revise your kit page once, at the same link, at no cost. Templates and checklists only, no outcome guarantee.

Get the next Drupal advisory checklist

Leave your email and we will send one email when we publish the next checklist for a Drupal core or major module advisory. No other mail, no sharing your address. Unsubscribe any time with the link, at /unsubscribe, or reply STOP to fuseini.metadata@gmail.com.

Privacy: we store your email address and the time you signed up, nothing else, to send that one email. It is kept on Cloudflare. We do not sell or share it.