91ÑÇÉ«

Information Security Advisory

A recently disclosed vulnerability (CVE-2026-108097) affects Drupal Core and may allow remote attackers to execute arbitrary code on vulnerable servers.

Severity level:
Critical

Description:
CVE-2026-108097 is a critical remote code execution vulnerability in the Field UI module (field_ui) included with Drupal Core. The vulnerability is not directly exploitable through Drupal Core alone; however, contributed modules and custom code may expose the affected functionality.

Affected Versions:
The vulnerability affects the following Drupal Core versions:

• Drupal 8.9.0 through 10.6.18
• Drupal 11.0.0 through 11.3.18
• Drupal 12.0.0-alpha1 through 12.0.0-beta1

Impact:
Successful exploitation may allow attackers to execute arbitrary code on Drupal servers.

Resolution:
Upgrade affected Drupal installation immediately to the following fixed versions or later.

• Drupal 10.6.19 or later
• Drupal 11.3.19 or later
• Drupal 11.4.10 or later
• Drupal 12.0.0-beta2 or later

Reference:

UIT Information Security




Contact

IT Client Services at askIT@yorku.ca or 416 736 5800

 | VISIT WWW.YORKU.CA
This email was sent by: 91ÑÇÉ«, 4700 Keele Street, Toronto, Ontario M3J 1P3

This email is viewed best in Microsoft Outlook for web