Drupal patches two critical RCE flaws, warns exploits may come fast

Drupal's security team has released fixes for two critical vulnerabilities that let attackers execute arbitrary code remotely on sites running any supported version of the content management system.

The flaws affect the Field UI module in Drupal core and the contributed Entity List module. The project gave advance notice earlier in the week, strongly urging administrators to set aside time for the updates: according to the security team, exploits could appear "within hours or days" of disclosure. Users were advised to move to the latest patch release for their branch before October 14, so they could resolve any related upgrade issues before the security window opened.

What the flaws are

Drupal is a free, open-source CMS especially popular with government agencies, universities, and non-profits. The project reports that more than a million websites run on it. All currently supported versions of the core are affected, the developers said.

The first issue, CVE-2026-108097, lies in the core Field UI module. It cannot be exploited through core alone, but contributed modules open several attack paths, including at least one that requires no authentication. Custom code can also expose the vulnerable functionality.

The second, CVE-2026-108099, concerns Entity List, a contributed module for building entity lists without Views. Exploiting it likewise requires interaction with contributed or custom modules, and at least one known path needs no authentication.

What administrators should do

Drupal core should be updated to version 10.6.19, 11.3.19, or 11.4.10 depending on the branch, and Entity List to 3.0.10. All versions prior to Drupal 10.6.x, as well as every Drupal 11 release before 11.3.x, are end-of-life and no longer supported.

The flaws also affect Drupal 12 pre-releases before beta2, though those are not meant for production; the final stable 12.0 will ship with the fixes already in place. Those who cannot upgrade are advised to uninstall the core Field UI module as an effective mitigation. Drupal Steward guards against some known attack vectors but does not cover every possible exploit.

Source: Bleeping Computer