DRUPAL PATCHES CRITICAL FIELD UI FLAW WITH UNAUTHENTICATED RCE PATH VIA CONTRIBUTED MODULES

Summary from the TLDR InfoSec newsletter

Drupal has fixed CVE-2026-108097, a critical Field UI flaw rated 19/25 that can lead to remote code execution through contributed modules with no authentication.