CVE-2026-108097
EPSS 0.3%Vendor advisory + public PoC + urgent patches confirm active exploitation risk; not yet KEV-listed but signal strong.
What: Critical unauthenticated remote code execution in Drupal core's Field UI module (CVE-2026-108097), exploitable via contributed modules; affects all supported Drupal versions.
Why it matters: Drupal issued emergency patches (10.6.19, 11.3.19, 11.4.10) on 2026-10-14. Public PoC code and exploit details are circulating. Post 7 explicitly confirms "Details and PoC code are public." Vendors (Drupal) patching urgently; defenders actively triaging and updating. Not yet KEV-listed, but vendor advisory is authoritative and exploitation window is live.
Where it's seen: Drupal security advisories, threat intelligence feeds (threatintel.cc), security bulletin aggregators, and multilingual security communities discussing patch urgency and mitigation (uninstalling field_ui). High engagement on practitioner channels; chatter emphasizes "within hours/days" exploit emergence.
RISK: CRITICAL — Unauthenticated RCE in core module, public PoC, all supported versions affected, urgent patching underway.
Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.