Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical remote code execution flaws and warned exploits could appear within hours or days.
Drupal patched two critical remote code execution vulnerabilities affecting every supported core release, on a CMS used by more than one million websites, including government, university, and nonprofit sites. CVE-2026-108097 is in the core Field UI module and cannot be exploited through core alone, but contributed modules or custom code can expose it, including at least one unauthenticated path. CVE-2026-108099 affects the contributed Entity List module and likewise has at least one known unauthenticated path when combined with other code. Fixed versions are Drupal 10.6.19, 11.3.19, and 11.4.10, plus Entity List 3.0.10; Drupal warned exploits might appear within hours or days but did not report active exploitation.
- Both flaws allow remote code execution on affected Drupal sites.
- Each has at least one exploitation path requiring no authentication.
- Field UI cannot be exploited through Drupal core alone.
- Patched versions are 10.6.19, 11.3.19, 11.4.10, and Entity List 3.0.10.
- No active exploitation is reported, but exploits may appear quickly.
- Vendors
- Drupal
- Products
- DrupalField UIEntity List
- Organizations
- Drupal
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — | |
| CVE-2026-108099 | — | — | — |
From the original article
2 min read at bleepingcomputer.com
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.