Drupal patches critical RCE flaws in core and Entity List module
Administrators must update Drupal core and the Entity List module to fix two remote code execution vulnerabilities that affect all supported versions.
Key points
- Drupal released fixes for two critical remote code execution flaws, CVE-2026-108097 and CVE-2026-108099, affecting all supported core versions.
- The Field UI and Entity List modules contain vulnerabilities that can be exploited without authentication if specific contributed modules are present.
- Users must upgrade to Drupal 10.6.19, 11.3.19, or 11.4.10 and Entity List 3.0.10; earlier branches are end-of-life.
Drupal has released patches for two critical vulnerabilities that allow remote code execution on any supported version of the content management system. The open-source project issued an advance warning earlier in the week, urging administrators to apply updates immediately because attackers could develop exploits shortly after the public disclosure of these security issues.
The flaws reside in the software core’s Field UI module and the contributed Entity List module. According to BleepingComputer, Drupal’s security team stated that exploits might emerge within hours or days of the advisory release. The team recommended updating to the latest supported patch release before October 14 to address any potential upgrade complications before the security window opens.
Technical details of the vulnerabilities
CVE-2026-108097 affects the Field UI module within Drupal core. This vulnerability allows attackers to execute arbitrary code on affected servers. The security advisory notes that the flaw cannot be exploited using Drupal core alone. However, contributed modules can provide multiple exploitation paths. At least one of these paths requires no authentication, meaning an attacker does not need valid credentials to trigger the exploit.
CVE-2026-108099 is a flaw in Entity List, a contributed module used for creating entity lists without using Views. This issue also enables remote code execution. Successful exploitation requires similar interaction with contributed modules or custom code. Like the Field UI vulnerability, this flaw includes at least one known exploitation path that does not require authentication, significantly increasing the risk to unpatched systems.
Scope and version support
Drupal is widely used by government agencies, universities, and non-profit organizations to build and manage websites. According to the project’s website, more than one million websites run on the platform. The security issues impact all currently supported versions of Drupal core. Administrators using unsupported versions are at risk but are not covered by these specific patches.
The developer specified that all versions of Drupal prior to 10.6.x are end-of-life. Additionally, all versions of Drupal 11 prior to 11.3.x are no longer supported. Users on these older branches should migrate to supported versions immediately. The recommended update targets are Drupal core version 10.6.19, 11.3.19, or 11.4.10, depending on the release branch in use.
What should you do?
Administrators should verify their current Drupal core and Entity List module versions against the patched releases. Identify any contributed modules that might interact with the Field UI or Entity List functionality. Review custom code for potential exposure to the vulnerable functionality. Schedule immediate updates to the specified patch versions to mitigate the risk of remote code execution.
What to do and how to stay safe: Drupal
- Inventory all Drupal instances and check current core versions against the supported 10.6.x, 11.3.x, and 11.4.x branches.
- Identify sites using the Entity List module and plan to update it to version 3.0.10 immediately.
- Review server access logs for signs of unauthorized execution attempts or anomalies in the days following the disclosure.
- Ensure backup procedures are active before applying updates to facilitate rollback if compatibility issues arise.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVE IDs are associated with these Drupal vulnerabilities?
The vulnerabilities are identified as CVE-2026-108097 for the Field UI module and CVE-2026-108099 for the Entity List module.
Do these flaws require authentication to exploit?
No, both vulnerabilities include at least one known exploitation path that does not require authentication if specific contributed modules or custom code are present.
Which Drupal versions are no longer supported?
All versions of Drupal prior to 10.6.x and all versions of Drupal 11 prior to 11.3.x are end-of-life and no longer receive security updates.
