Drupal patches two critical remote code execution flaws

Drupal released patches for two critical remote code execution vulnerabilities affecting its core Field UI module and the contributed Entity List module, according to BleepingComputer. The advisories, published on October 17, 2026, track the flaws as CVE-2026-108097 and CVE-2026-108099.

CVE-2026-108097 is a remote code execution flaw in Drupal core's Field UI module. The advisory states the flaw cannot be exploited with Drupal core alone, but contributed modules can provide exploitation paths, including at least one that requires no authentication.

CVE-2026-108099 is a remote code execution flaw in the Entity List contributed module. Exploiting it requires similar interaction with contributed modules or custom code, and at least one known unauthenticated path exists.

Administrators are urged to update Drupal core to 10.6.19, 11.3.19 or 11.4.10 depending on their branch, and Entity List to 3.0.10. Drupal 12 pre-releases before beta2 are also affected; the stable 12.0 release will carry fixes for both flaws. Those unable to upgrade are advised to uninstall the core Field UI module (field_ui) as a mitigation. Drupal Steward protects against some known attack vectors but not every possible exploit.

Warning issued earlier in the week

At the beginning of the week, Drupal issued an advance warning urging administrators to apply updates promptly because exploits might be developed within hours or days. The project also recommended updating to the latest supported bugfix release before October 14 to resolve upgrade issues before the security window, and disclosed that all currently supported versions of Drupal core were affected. More than one million websites run on Drupal, according to the project's website. All versions prior to 10.6.x and all Drupal 11 versions prior to 11.3.x are end-of-life and no longer supported.