Drupal Patches Critical RCE Vulnerabilities and Warns
The open-source content management system has released updates to address two critical remote code execution flaws affecting multiple versions.
Radwan AbdulhadiEditor and technology writer
Overview of the Critical Drupal Vulnerabilities
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system, according to reporting by BleepingComputer.
The security issues impact the software core's Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to promptly apply updates because attackers could develop exploits shortly after the vulnerabilities are disclosed. According to official figures, more than one million websites run on Drupal.
Security Team Warnings and Timing
The project's security team warned administrators well in advance about the incoming software updates and potential threats.
The security team stated that administrators should reserve time for core updates because exploits might be developed within hours or days following disclosure. They recommended updating to the latest supported patch release before October 14 to address any other upgrade issues ahead of the security window.
Details of CVE-2026-108097 and CVE-2026-108099
The open-source project disclosed details concerning two distinct vulnerabilities affecting currently supported versions of Drupal core. CVE-2026-108097 involves a remote code execution vulnerability in Drupal core’s Field UI module that could allow attackers to execute arbitrary code on affected servers.
The second flaw, designated as CVE-2026-108099, affects Entity List, a contributed module utilized for creating entity lists without Views, which could likewise enable remote code execution.
Exploitation Pathways and Requirements
The security advisory for CVE-2026-108097 notes that the flaw cannot be exploited using Drupal core alone. Instead, contributed modules can provide multiple exploitation paths, including at least one path that requires no authentication. Additionally, custom code may expose the vulnerable functionality to external threats.
Successful exploitation of CVE-2026-108099 similarly requires interaction with contributed modules or custom code and includes at least one known exploitation path that does not require authentication.
Recommended Updates and Mitigation Steps
Administrators are strongly urged to update Drupal core to version 10.6.19, 11.3.19, or 11.4.10, depending on their specific release branch. Furthermore, the Entity List module should be updated to version 3.0.10.
The developer noted that all versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. The flaws also impact Drupal 12 pre-releases before beta2, though these are not intended for production environments, and the final stable 12.0 version will include fixes for both issues.
For administrators who cannot upgrade immediately to a secure version, uninstalling Drupal’s core Field UI module is advised as an effective mitigation measure. While Drupal Steward protects against some known attack vectors, it does not cover every possible exploit.
Sources
- BleepingComputerDrupal patches critical RCE flaws, warns exploits may emerge soon
Continue chronologically
Related stories
Drupal Warns of Critical Commerce Core Flaw in Active Attacks
Drupal urges administrators to patch a highly critical access bypass vulnerability in the Commerce Core module that is actively being exploited.
Drupal Warns of Active Exploits Against Commerce Core Flaw
Drupal urges online store owners to patch a critical Commerce Core access bypass vulnerability actively being exploited in the wild.
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws
Microsoft's October 2026 Patch Tuesday addresses a record-breaking 1,411 flaws, featuring three zero-day vulnerabilities and new risk cohorts.
PHP Warns Admins to Prepare for Two Critical Security Patches
PHP maintainers have issued an urgent warning to web developers and administrators to prepare for the release of two critical emergency patches.
