For CVE-2026-108097 / SA-CORE-2026-014, the Drupal Security Team's interim mitigation is to uninstall the core Field UI module (field_ui). That removes the vulnerable surface while you move to 10.6.19, 11.3.19, or 11.4.10. Prefer the patched release; Steward protection is partial. After update, re-enable Field UI only if you need it for site building, and audit contrib modules that touch field management UIs.