cyber.hendryadrian.com
Vulnerability & Exploit · socradar.io

Drupal Patches Two Critical RCE Vulnerabilities in Core and Entity List

· Original article ↗

Summary

Drupal patched two critical RCE flaws affecting core Field UI and the Entity List module. Exploitation requires vulnerable functionality exposed through integrations; no in-the-wild exploitation was confirmed as of October 19, 2026.

Key points

  • CVE-2026-108097 affects Drupal core’s Field UI module; CVE-2026-108099 affects the contributed Entity List module.
  • Both flaws are rated Critical by Drupal. Exploitation depends on contributed modules or custom code exposing the vulnerable functionality; at least one known path for each flaw requires no authentication.
  • Fixed versions are Drupal core 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2, plus Entity List 3.0.10.
  • Drupal reported no confirmed in-the-wild exploitation as of October 19, 2026. Its advisories do not identify public exploit code or documented exploit development.
  • Drupal recommends patching; if CVE-2026-108097 cannot be patched immediately, it advises uninstalling Field UI until an update is possible.
  • Review affected integrations and logs for suspicious activity, including unexpected PHP processes or files, modified web content, unusual administrator changes, and suspicious outbound connections.

Article Details

Vulnerability Types
  • Remote code execution
Severity
Critical (Drupal rating: 19/25; not a CVSS score)
Affected Versions
  • Drupal core 8.9.0 to <10.6.19
  • Drupal core 11.0.0 to <11.3.19
  • Drupal core 11.4.0 to <11.4.10
  • Drupal 12 pre-release 12.0.0-alpha1 to <12.0.0-beta2
  • Entity List below 3.0.10
Exploitation Status
not_reported
Exploit Availability
none_reported
Patch Status
available
Workarounds
  • If CVE-2026-108097 cannot be patched immediately, uninstall the Field UI (field_ui) module until the update can be deployed.
  • Drupal Steward protects against some known attack vectors, but Drupal warns it does not cover every possible exploit path and should not replace upgrading.

CVE

CVE-2026-108097Drupal Patches Critical RCEs: CVE-2026-108097 & 108099CVE-2026-108099The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple

Products

DrupalDrupal Patches Critical RCEs: CVE-2026-108097 & 108099Drupal StewardDrupal Steward protects against some known attack vectors, but Drupal explicitly warns that it does not cover every possible exploit path and should not replace upgrading.Entity ListDrupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module.Field UIThe first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple

Related Articles