Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical remote code execution flaws and warned exploits could appear within hours or days.
82
CVE-2026-108097
- CVSS
- —
- EPSS
- —
- Published
- —
- Modified
- —
In the news
7 storiesDrupal patches two critical RCE flaws and XSS bugs
Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19, plus Entity List 3.0.10; Field UI can be uninstalled.
74
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.
74
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Drupal warns of critical Field UI remote code execution, CVE-2026-108097, including an unauthenticated contributed-module path.
73
Drupal Field UI flaw can allow unauthenticated takeover (CVE-2026-108097)
Core alone is not directly exploitable, but contributed modules or custom code can open unauthenticated paths; no public exploit is reported.
64
Drupal warns of critical Field UI RCE in core (CVE-2026-108097)
Core alone is not directly exploitable, but at least one contributed-module path needs no login.
64
Drupal patches critical RCEs CVE-2026-108097 and CVE-2026-108099
The captured page gives no affected versions, fixed releases, or statement on exploitation.
46