Drupal Patches Critical RCE Vulnerabilities; Exploits Expected

Drupal released patches for two critical remote code execution vulnerabilities present in all currently supported versions of the content management system. One flaw resides in Drupal core’s Field UI module, while the second affects Entity List, a contributed module for displaying entities without the Views system. The project’s security team emphasized urgency, noting that working exploits could surface within days of public disclosure.

Both vulnerabilities require specific conditions for exploitation—neither can be triggered by Drupal core in isolation. Instead, attackers would need to leverage contributed modules or custom code to reach the vulnerable functionality. CVE-2026-108097 (Field UI) and CVE-2026-108099 (Entity List) each contain at least one known unauthenticated attack path when combined with such extensions.

Administrators should update Drupal core to versions 10.6.19, 11.3.19, or 11.4.10 depending on their branch, and upgrade Entity List to 3.0.10. Those unable to patch immediately can uninstall the Field UI module as a temporary measure. Drupal powers over a million websites globally, with significant deployment in government, academic, and nonprofit sectors.