Two critical vulnerabilities allowing remote code execution have been patched by Drupal across all currently supported versions of the platform. The flaws reside in the core Field UI module and the Entity List contributed module, prompting urgent guidance from the project's maintainers.

Drupal's security team issued an early alert this week emphasizing the need for rapid deployment of updates. The project cautioned that functional exploits could materialize rapidly following public disclosure. According to the advisory, "The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days."

The team further stated, "We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window."

Drupal powers more than one million websites globally and maintains particular prominence among government bodies, educational institutions, and nonprofit organizations. The platform is distributed as free, open-source software.

Vulnerability details

  • CVE-2026-108097: A remote code execution flaw in Drupal core's Field UI module permitting arbitrary code execution on vulnerable systems.
  • CVE-2026-108099: A remote code execution issue in Entity List, a contributed module designed for generating entity lists without Views.

The CVE-2026-108097 advisory notes that exploitation cannot occur through Drupal core in isolation. However, contributed modules can furnish multiple attack vectors, with at least one requiring no user authentication. Custom implementations may similarly expose the vulnerable code path.

Exploitation of CVE-2026-108099 similarly demands interaction with contributed modules or custom code and includes at least one documented attack path that bypasses authentication requirements.

Recommended updates

Site operators should upgrade Drupal core to version 10.6.19, 11.3.19, or 11.4.10 based on their active release line, and update Entity List to version 3.0.10.

The developer noted that "All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported." Drupal 12 pre-releases before beta2 are also affected, though these versions are not intended for production deployment. The forthcoming stable 12.0 release will incorporate fixes for both vulnerabilities.

Mitigation options

For administrators unable to apply updates immediately, uninstalling the core Field UI module (field_ui) provides an effective temporary mitigation. Drupal Steward offers protection against certain known attack methods but does not address all potential exploitation techniques.