Drupal patches critical RCE flaws, warns exploits may emerge soon

Two critical remote code execution vulnerabilities (CVE-2026-108097 and CVE-2026-108099) were discovered in Drupal's core Field UI module and the contributed Entity List module. Both vulnerabilities allow remote attackers to execute arbitrary code on affected servers, with at least one exploitation path for each flaw requiring no authentication and involving contributed modules or custom code. Drupal core alone is not exploitable for CVE-2026-108097, but combined with contributed modules or custom code, it becomes vulnerable. The vulnerabilities affect all currently supported Drupal core versions and pre-release Drupal 12 versions before beta2. Drupal has released patched versions 10.6.19, 11.3.19, and 11.4.10 for core and 3.0.10 for the Entity List module. Administrators unable to upgrade immediately are advised to uninstall the Field UI module as a mitigation. The Drupal Security Team warns that exploits may be developed within hours or days of disclosure, urging prompt updates.

Successful exploitation of these vulnerabilities allows remote attackers to execute arbitrary code on affected Drupal servers, potentially leading to full system compromise. Some exploitation paths require no authentication, increasing the risk of widespread attacks. The vulnerabilities affect all supported Drupal core versions and the contributed Entity List module, as well as pre-release Drupal 12 versions before beta2. This poses a critical risk to websites running vulnerable versions, including government, university, and non-profit sites that commonly use Drupal.

Drupal has released official patches for these vulnerabilities in core versions 10.6.19, 11.3.19, and 11.4.10, and Entity List module version 3.0.10. Administrators should promptly update to these versions to mitigate the risk. For those unable to upgrade immediately, uninstalling the Field UI module (field_ui) is an effective mitigation. Drupal Steward provides partial protection but does not cover all exploit vectors. Monitoring vendor advisories for further updates is recommended.