Drupal Patches Critical Core RCE Flaws, Warns of Rapid Exploitation Risk
Drupal releases updates for five vulnerabilities, including two critical remote code execution flaws in core and contributed modules.
Key points
- Drupal patched CVE-2026-108099 in Entity List and CVE-2026-108097 in Field UI.
- At least one exploit path for the Field UI flaw requires no authentication.
- Users must update to Drupal 11.4.10, 11.3.19, or 10.6.19 to address the issues.
Drupal has released security updates addressing five vulnerabilities, including two critical-severity bugs that enable remote code execution. The project warns that exploits for these flaws could be developed within hours or days of disclosure, urging administrators to prioritize patching immediately.
The first critical vulnerability, tracked as CVE-2026-108099, resides in the Entity List module. This module allows users to create entity lists without using Views. While the flaw is not exploitable using the module alone, Drupal states that exploit paths exist when combined with other contributed modules. At least one known attack path does not require authentication, and custom code may also expose the vulnerable functionality.
The second critical issue, CVE-2026-108097, impacts the Field UI module in Drupal core. Similar to the Entity List flaw, this vulnerability is not exploitable with Drupal core alone. However, contributed modules provide serious exploit paths, including at least one that does not require authentication. As a mitigation measure, users can uninstall the core Field UI module.
Context and Background
Drupal advises users to update to Entity List version 3.0.10 and to Drupal versions 11.4.10, 11.3.19, or 10.6.19 to resolve these critical issues. The project notes that previous Drupal releases have reached end-of-life and no longer receive security updates, meaning those installations remain exposed to these threats indefinitely.
In addition to the remote code execution flaws, the updates resolve cross-site scripting vulnerabilities. CVE-2026-108515 addresses XSS holes in the Drupal core Link module, while CVE-2026-108514 fixes an XSS flaw in the Navigation module. Drupal also announced patches for a security defect in the Gin administration theme that could lead to XSS attacks.
Gin versions 5.0.16 and 4.1.4 contain fixes for the theme-related bug. Drupal makes no mention of any of these five vulnerabilities being exploited in the wild at this time. However, the project’s warning on October 12 regarding rapid exploit development suggests the risk is imminent.
Who Is Affected
Administrators running Drupal 10.6.x, 11.3.x, or 11.4.x branches are affected by the core Field UI vulnerability. Sites using the Entity List module are vulnerable to CVE-2026-108099 if they also use other contributed modules that create exploit paths. Custom code implementations may also expose the Entity List vulnerability even without specific contributed modules.
Users of the Gin administration theme are affected by the separate XSS vulnerability. Those using older, end-of-life versions of Drupal cannot apply these patches and remain at risk. Organizations relying on contributed modules should verify compatibility with the updated core versions before applying fixes.
What should you do?
Administrators should immediately verify their current Drupal version and installed modules against the affected lists. Prioritize updating to the specified secure versions, especially for sites with public-facing forms or user-generated content. Monitor security advisories for further developments regarding exploit availability.
What to do and how to stay safe: Drupal
- Check your Drupal version and installed modules to see if you are running affected versions of Entity List or Field UI.
- Update to Drupal 11.4.10, 11.3.19, or 10.6.19, and Entity List 3.0.10, as soon as maintenance windows allow.
- Uninstall the core Field UI module if you cannot update immediately, as a temporary mitigation for CVE-2026-108097.
- Review custom code and contributed modules for potential exploit paths that do not require authentication.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Drupal versions are patched for the critical RCE flaws?
Drupal versions 11.4.10, 11.3.19, and 10.6.19 contain fixes for the core Field UI vulnerability.
Is the Entity List vulnerability exploitable without other modules?
No, the Entity List flaw is not exploitable with the module alone, but exploit paths exist with other contributed modules.
Are these vulnerabilities currently being exploited in the wild?
Drupal states that it has no mention of these vulnerabilities being exploited in the wild at this time.
