Drupal Patches Critical Remote Code Execution Vulnerabilities

Drupal has patched two critical vulnerabilities that could allow attackers to remotely execute code on websites running supported versions of the content management system.

The flaws affect Drupal’s core Field UI module and the contributed Entity List module. Drupal issued an advance warning earlier this week, urging administrators to apply the security updates quickly because exploits could be developed within hours or days of disclosure.

“The Drupal security team recommends that you allow time for core updates at that time, as exploits can develop within hours or days,” the project said in a security team warning.

“We recommend that you update to the latest supported patch (bug fix) release for your site’s Drupal version by October 14th so that you can address any other upgrade issues before the security period begins.”

Drupal vulnerabilities could enable remote code execution

Drupal is a free, open-source content management system used to build and manage websites. It is especially popular among government agencies, universities and nonprofit organizations.

According to the Drupal website, the platform runs on 1 million websites.

The open-source project said that all currently supported versions of Drupal core are affected. The vulnerabilities are:

• CVE-2026-108097: A remote code execution vulnerability in the Drupal Core Field UI module that could allow an attacker to execute arbitrary code on an affected server.
• CVE-2026-108099: A flaw in Entity List, a provided module for creating viewless entity lists, that could potentially lead to remote code execution.

The security advisory for CVE-2026-108097 states that the vulnerability cannot be exploited using Drupal core alone. However, the provided module may create multiple exploitation paths, including at least one that does not require authentication.

Custom code can also expose vulnerable functionality.

Successful exploitation of CVE-2026-108099 similarly requires interaction with a provided module or custom code. The vulnerability includes at least one known exploitation path that does not require authentication.

Drupal versions affected and required updates

Administrators should update Drupal core to version 10.6.19, 11.3.19 or 11.4.10, depending on the release branch. The Entity List module should be updated to version 3.0.10.

“All versions of Drupal prior to 10.6.x and all versions of Drupal 11 prior to 11.3.x are End of Life and no longer supported,” the developer said.

The vulnerabilities also affect Drupal 12 pre-releases before Beta 2. Those releases are not intended for production use. The final stable version of Drupal 12.0 will include fixes for both flaws.

Drupal security mitigation for administrators

Administrators who cannot upgrade to a secure version should uninstall Drupal’s core Field UI module, field_ui, as an effective mitigation.

Drupal Steward protects against some known attack vectors, but it does not cover all possible exploits.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report