Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw

Two critical RCE vulnerabilities were identified in Drupal: CVE-2026-108099 in the Entity List module and CVE-2026-108097 in the Field UI module. Both are not exploitable in isolation but can be exploited via contributed modules, with at least one unauthenticated exploit path. Drupal has issued patches in Entity List version 3.0.10 and Drupal core versions 11.4.10, 11.3.19, and 10.6.19. Additional XSS vulnerabilities in other modules were also patched. Drupal recommends uninstalling the Field UI module if not needed. No known exploitation in the wild has been reported, but rapid exploitation is anticipated.

Successful exploitation could allow remote code execution on affected Drupal installations, potentially leading to full system compromise. The vulnerabilities require specific module combinations or custom code to be exploitable, and some exploit paths do not require authentication, increasing risk. No confirmed active exploitation has been reported.

Apply the official patches by updating to Entity List version 3.0.10 and Drupal core versions 11.4.10, 11.3.19, or 10.6.19. If the Field UI module is not required, uninstall it to mitigate risk. Monitor Drupal’s security advisories for further updates. No additional action is required beyond applying these updates and recommended mitigations.