Drupal has fixed two critical vulnerabilities that could allow attackers to remotely execute code on websites running a supported version of the content management system.
The security issues affect the Field UI module of the software kernel and the contributed Entity List module. Drupal issued a warning earlier this week, urging administrators to apply updates immediately because attackers could develop exploits shortly after the vulnerabilities became known.
“The Drupal security team strongly recommends that you allow time for core updates at this time, as exploits may be developed within hours or days,” the project says Security team warned.
“We recommend upgrading to the latest supported patch version (bug fix) for your site’s Drupal version before October 14th so that you can resolve any other upgrade issues before the security window.”
Drupal is a free, open-source content management system for building and managing websites that is particularly popular among government agencies, universities, and nonprofit organizations.
According to the project’s website, more than a million websites runs on Drupal.
Earlier this week, the open source project announced the two details, noting that “all currently supported versions of Drupal core are affected.”
- CVE-2026-108097: A remote code execution vulnerability in the Field UI module of Drupal Core that could allow attackers to execute arbitrary code on affected servers.
- CVE-2026-108099: A bug in Entity List, a contributed module for creating entity lists without views, that could allow remote code execution.
The security advisory for CVE-2026-108097 notes that the vulnerability cannot be exploited using the Drupal core alone, but that deployed modules can provide multiple exploitation paths, including at least one that does not require authentication.
Additionally, custom code can also expose the vulnerable functionality.
Successful exploitation of CVE-2026-108099 requires similar interaction with deployed modules or custom code and involves at least one known exploitation path that does not require authentication.
Administrators are urged to update the Drupal core to version 10.6.19, 11.3.19, or 11.4.10 depending on the release branch and update the entity list to 3.0.10.
“All versions of Drupal prior to 10.6.x and all versions of Drupal 11 prior to 11.3.x are deprecated and no longer supported,” the developer said
The defects also affect pre-release versions of Drupal 12 before Beta2, but these are not intended for use in production environments. The final stable version 12.0 will contain fixes for both bugs.
For administrators who cannot upgrade to a secure version, an effective workaround is to uninstall Drupal’s core Field UI module (field_ui).
Additionally, Drupal Steward protects against some known attack vectors, but does not cover all possible exploits.
