Drupal patches critical Field UI and Entity List RCE flaws
October 19 reports add the 19-of-25 score, affected ranges including Drupal 12, theoretical exploit status, Field UI uninstall mitigation, and credit to Drew Webber and Octavio Galland.
Drupal has patched critical RCEs in Field UI and Entity List; core alone is not directly exploitable, and no attacks are reported.
Drupal advisory SA-CORE-2026-014, published October 14, 2026, covers CVE-2026-108097, a critical remote code execution flaw in the core Field UI module scored 19 out of 25. Core by itself does not expose a direct route, but contributed modules or custom code can, including at least one path that needs no login. SecurityWeek reports a second critical RCE, CVE-2026-108099 in Entity List, which likewise is not exploitable by that component alone, plus XSS fixes in Link, Navigation, and the Gin theme. Drupal lists exploitation of CVE-2026-108097 as theoretical, with no public exploit or reported attacks, though on October 12 it warned exploits might appear within hours or days. Fixed core releases are 10.6.19, 11.3.19, and 11.4.10; uninstalling field_ui is the stated mitigation until sites update.
- CVE-2026-108097 affects 8.9.0 before 10.6.19, 11.x before 11.3.19, and 11.4.0 before 11.4.10.
- Drupal 12 builds from 12.0.0-alpha1 before 12.0.0-beta2 are also affected.
- Entity List should be updated to 3.0.10; Gin XSS fixes are 5.0.16 and 4.1.4.
- Drupal 8, 9, 10.5.x and earlier, and 11.2.x and earlier are unsupported.
- Drupal Steward blocks some known paths but does not replace upgrading.
- Drew Webber and Octavio Galland are credited with the Field UI report.
Timeline
dated events in the reporting · oldest first- Oct 12, 2026Drupal warned exploits might appear within hours or days. · SecurityWeek
- Oct 14, 2026Drupal published advisory SA-CORE-2026-014 for CVE-2026-108097. · GBHackers
What each outlet adds
beyond the shared facts- GBHackersRisk score, Drupal 12 range, reporter credits, and Steward limits.
- SecurityWeekEntity List RCE, XSS CVEs, and October 12 warning.
- Cyber Security NewsStates no public exploit and no reported attacks.
- SOCRadarHeadline names both RCE CVEs but gives no versions.
- Vendors
- Drupal
- Products
- Entity ListField UIGin
- Organizations
- Drupal Security Team
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
Drupal warns of critical Field UI RCE in core (CVE-2026-108097)
Core alone is not directly exploitable, but at least one contributed-module path needs no login.
- · 6d ago
SOCRadar
Drupal patches critical RCEs CVE-2026-108097 and CVE-2026-108099
The captured page gives no affected versions, fixed releases, or statement on exploitation.
- · 6d ago
SecurityWeek
Drupal patches two critical RCE flaws and XSS bugs
Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19, plus Entity List 3.0.10; Field UI can be uninstalled.
- · 6d ago
Cyber Security News
Drupal Field UI flaw can allow unauthenticated takeover (CVE-2026-108097)
Core alone is not directly exploitable, but contributed modules or custom code can open unauthenticated paths; no public exploit is reported.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — | |
| CVE-2026-108099 | — | — | — | ||
| CVE-2026-108514 | — | — | — | ||
| CVE-2026-108515 | — | — | — |