Drupal patches critical RCE flaws and warns exploits may emerge soon

Drupal has released fixes for two critical remote-code-execution vulnerabilities affecting supported versions of the open-source content management system. The project is urging site administrators to apply the updates promptly, warning that attackers may develop working exploits within hours or days of disclosure.¹²

The first issue, CVE-2026-108097, affects Drupal core’s Field UI module. The second, CVE-2026-108099, affects the contributed Entity List module, which is used to create entity lists without Views. Drupal’s security advisory says both flaws can become exploitable through contributed modules or custom code, and at least one known path for each vulnerability does not require authentication.²

Administrators should update Drupal core to version 10.6.19, 11.3.19 or 11.4.10, depending on the release branch they use. Entity List users should update to version 3.0.10. The affected releases include currently supported Drupal versions, while older versions that have reached end of life should not be treated as safe simply because they are outside the supported patch branches.²

Drupal says the Field UI issue cannot be exploited using Drupal core alone, but contributed modules can provide routes into the vulnerable functionality. Custom code may also expose it. That makes the exact risk dependent on how a site is built, but it does not remove the need to patch: a widely used module or bespoke integration can turn a theoretical weakness into a practical route to code execution.

The project says operators who cannot upgrade immediately can uninstall Drupal’s core Field UI module as a mitigation. That is not a substitute for the security update, and teams should check the effect on their own editorial workflows before removing a component. Drupal Steward may protect against some known attack paths, but Drupal says it does not cover every possible exploit.²

BleepingComputer reports that Drupal supports more than one million websites, including sites used by government agencies, universities and non-profit organisations.¹ The scale makes routine patching particularly important: attackers do not need every Drupal installation to be vulnerable if they can reliably identify a smaller set of exposed, poorly maintained targets.

Our opinion

The important detail here is not just the critical severity label. Both advisories describe realistic ways that contributed modules or custom code can connect a vulnerable function to an attacker, including unauthenticated paths. Site owners should inventory those integrations, patch the supported branch they actually run and treat end-of-life Drupal versions as an upgrade project rather than a permanent exception.