CVE-2026-108097

Published on Oct 30, 2026

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

Early warning: exploitation observed

Exploitation observed since Nov 11, 2026
Not yet in the official CISA catalogue
First attack observed 12 days after disclosure
Confirmed by sensors, not only by reports

Source: VulnCheck KEV · Nov 12, 2026 Nov 11, 2026

Weakness type (CWE)CWE-470

Vulnerabilities

Drupal Fixes Critical Field UI RCE Reachable Without Login Through Add-Ons

Drupal patched a critical Field UI flaw that could allow remote code execution via contributed modules, including without login. Update to fixed releases.

Oct 15, 202614:02 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

Drupal Fixes Critical Field UI RCE Reachable Without Login Through Add-Ons