CVE-2026-108099

CVE Enrichment

CISA KEV: Not listed

Last enrichment sync: 23-Oct-2026 01:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (5)

Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon as Drupal Warns of Actively Exploited Commerce Core Access Bypass
The first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099. Drupal Patches Two Critical Core Flaws With Potential Unauthenticated RCE Paths
The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple Drupal Patches Two Critical RCE Vulnerabilities in Core and Entity List
CVE-2026-108099: A flaw in Entity List, a contributed module for creating entity lists without Views, that could enable remote code execution. Drupal patches two critical remote code execution flaws
Separately, the Entity List module received its own critical remote code execution advisory, CVE-2026-108099, with the same conditions, including a known path that needs no login. Its 3.0.10 release note says the fix Drupal Patches Critical Field UI RCE Flaw Requiring Contributed Module Exposure

CVE (5)

People (2)

Vendors (1)

Products (9)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.