---
title: Tip: if you can't patch Drupal tonight, uninstall field_ui until you can | ctxsec
url: https://ctxsec.com/items/tip-drupal-field-ui-108097
description: ""
status: "tip"
published: 2026-10-14
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-drupal-field-ui-108097.md)

tip

2026-10-14

### Tip: if you can't patch Drupal tonight, uninstall field_ui until you can

For CVE-2026-108097 / SA-CORE-2026-014, the Drupal Security Team's interim mitigation is to uninstall the core Field UI module (field_ui). That removes the vulnerable surface while you move to 10.6.19, 11.3.19, or 11.4.10. Prefer the patched release; Steward protection is partial. After update, re-enable Field UI only if you need it for site building, and audit contrib modules that touch field management UIs.

Sources: [Drupal SA-CORE-2026-014](https://www.drupal.org/sa-core-2026-014)