Drupal patches two critical remote code execution flaws
Summary
Drupal patched two critical RCE flaws affecting supported versions. Some exploitation paths require contributed modules or custom code and may need no authentication. Administrators should update Drupal core and Entity List or uninstall Field UI as a mitigation.
Key points
- CVE-2026-108097 affects Drupal core’s Field UI module; contributed modules or custom code can expose exploitation paths, including one that requires no authentication.
- CVE-2026-108099 affects the contributed Entity List module and also has a known exploitation path that does not require authentication.
- Drupal urged administrators to apply updates promptly, warning exploits could emerge within hours or days of disclosure.
- Update Drupal core to 10.6.19, 11.3.19, or 11.4.10, as appropriate, and Entity List to 3.0.10.
- Drupal versions before 10.6.x and Drupal 11 versions before 11.3.x are end-of-life and unsupported.
- For administrators unable to upgrade, Drupal recommends uninstalling the core Field UI module; Drupal Steward covers some known attack vectors but not all.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical
- Affected Versions
- Drupal core: all currently supported versions
- Drupal core: versions prior to 10.6.x
- Drupal core: Drupal 11 versions prior to 11.3.x
- Drupal 12 pre-releases before beta2
- Entity List: versions prior to 3.0.10
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Uninstall Drupal core's Field UI module (field_ui) if unable to upgrade; the article describes this as an effective mitigation.
CVE
CVE-2026-108097CVE-2026-108097: A remote code execution vulnerability in Drupal core’s Field UI module that could allow attackers to execute arbitrary code on affected servers.CVE-2026-108099CVE-2026-108099: A flaw in Entity List, a contributed module for creating entity lists without Views, that could enable remote code execution.
People
Products
DrupalDrupal patches critical RCE flaws, warns exploits may emerge soonDrupal StewardAlso, Drupal Steward protects against some known attack vectors but does not cover every possible exploit.Entity ListThe security issues impact the software core's Field UI module and the contributed Entity List module.