CVE-2026-108097

CVE Enrichment

CISA KEV: Not listed

Last enrichment sync: 23-Oct-2026 01:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (5)

Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon as Drupal Warns of Actively Exploited Commerce Core Access Bypass
The second impacts the Field UI module in Drupal core and is tracked as CVE-2026-108097. Drupal Patches Two Critical Core Flaws With Potential Unauthenticated RCE Paths
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099 Drupal Patches Two Critical RCE Vulnerabilities in Core and Entity List
CVE-2026-108097: A remote code execution vulnerability in Drupal core’s Field UI module that could allow attackers to execute arbitrary code on affected servers. Drupal patches two critical remote code execution flaws
Tracked as CVE-2026-108097, the flaw sits in Field UI, the core module behind the admin pages where site builders manage fields and how they display. Drupal rates it 19 out of 25 on its own risk scale, the level the Drupal Patches Critical Field UI RCE Flaw Requiring Contributed Module Exposure

CVE (5)

People (2)

Vendors (1)

Products (9)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.