Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
The security issues impact the software core’s Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to apply updates promptly because attackers could develop exploits shortly after the vulnerabilities’ disclosure.
“The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the project’s security team warned.
“We recommend updating to the latest supported patch (bugfix) release for your site’s version of Drupal before October 14, so that you can address any other upgrade issues before the security window.”
Drupal is a free, open-source content management system used to build and manage websites, particularly popular among government agencies, universities, and non-profit organizations.
According to the project’s website, more than one million websites run on Drupal.
Earlier this week, the open-source project disclosed the two details, noting that “all currently supported versions of Drupal core are affected.”
- CVE-2026-108097: A remote code execution vulnerability in Drupal core’s Field UI module that could allow attackers to execute arbitrary code on affected servers.
- CVE-2026-108099: A flaw in Entity List, a contributed module for creating entity lists without Views, that could enable remote code execution.
The security advisory for CVE-2026-108097 notes that the flaw cannot be exploited using Drupal core alone, but contributed modules can provide multiple exploitation paths, including at least one that requires no authentication.
Additionally, custom code may also expose the vulnerable functionality.
Successful exploitation of CVE-2026-108099 requires a similar interaction with contributed modules or custom code and includes at least one known exploitation path that does not require authentication.
Administrators are urged to update Drupal core to version 10.6.19, 11.3.19, or 11.4.10, depending on their release branch, and update Entity List to 3.0.10.
“All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported,” the developer said
The flaws also impact Drupal 12 pre-releases before beta2, but these are not meant to be used in production environments. The final stable 12.0 version will include fixes for both flaws.
Administrators who cannot upgrade to a secure version are advised to uninstall Drupal’s core Field UI module (field_ui) as an effective mitigation measure.
Also, Drupal Steward protects against some known attack vectors but does not cover every possible exploit.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.