Drupal RCE Flaws Patched as Exploit Warning Issued

Drupal has released security updates for two critical vulnerabilities that could allow remote code execution on affected websites. The Drupal RCE flaws involve the core Field UI module and the contributed Entity List module.

The project’s security team warned that attackers could develop exploits within hours or days of disclosure. Consequently, administrators should prioritize the updates while checking which modules and custom code their websites use.

Two Vulnerabilities Expose Websites to Code Execution

The first vulnerability, CVE-2026-108097, affects Drupal core’s Field UI module. Although all supported core versions contain the flaw, attackers cannot exploit it through Drupal core alone.

Instead, contributed modules can expose the vulnerable functionality through several attack paths. At least one known path requires no authentication. Custom website code may also create conditions that enable exploitation.

The second issue, CVE-2026-108099, affects Entity List. This contributed module lets administrators create entity lists without using Views.

Similarly, exploiting the Entity List flaw depends on interactions with contributed modules or custom code. Researchers have identified at least one attack path that does not require authentication.

These conditions mean that a website’s configuration matters. However, administrators should not assume their installations are safe simply because exploitation requires additional components.

Security Team Warned Administrators Before Disclosure

Drupal issued an advance notice on October 12, asking website operators to prepare for the security release.

The team recommended installing the latest supported bugfix release for each website’s branch before October 14. That preparation would help administrators resolve unrelated upgrade problems before applying the security patches.

The warning highlighted how quickly attackers might turn vulnerability details into working exploits. However, the supplied disclosure does not confirm active attacks against these Drupal RCE flaws.

Drupal powers more than one million websites, according to the project. Government agencies, universities and nonprofit organizations are among its users.

Which Drupal Versions Contain the Fixes?

Administrators should install the patched release that matches their supported branch:

• Drupal 10.6: Update to 10.6.19.
• Drupal 11.3: Update to 11.3.19.
• Drupal 11.4: Update to 11.4.10.
• Entity List: Update the contributed module to 3.0.10.

Meanwhile, Drupal versions earlier than 10.6.x have reached end of life. Drupal 11 releases before 11.3.x also no longer receive support.

Operators using those older branches therefore need to move to a supported release.

The vulnerabilities also affect Drupal 12 prereleases earlier than beta2. Those development versions are unsuitable for production websites, while the final Drupal 12.0 release will include both fixes.

Field UI Removal Offers a Temporary Mitigation

For administrators who cannot immediately upgrade, Drupal recommends uninstalling the core Field UI module, identified as field_ui.

This provides an effective mitigation while operators arrange the required updates. Nevertheless, installing the fixed releases remains the recommended way to address the vulnerabilities.

Drupal Steward offers protection against some known attack methods. However, it does not cover every possible exploitation path, so administrators should still apply the patches or recommended mitigation.