Drupal fixed two critical code execution flaws. It says exploits may come within hours.
By Lior AharonovFounder, 7IT Solutions ·
BleepingComputer reported on 17 October 2026 that Drupal patched CVE-2026-108097 in core Field UI and CVE-2026-108099 in the Entity List module, both remote code execution flaws rated critical. Fixes are in core 10.6.19, 11.3.19 and 11.4.10, and Entity List 3.0.10. Drupal had warned earlier in the week that exploits could appear within hours or days.
A site on Drupal that nobody has touched since launch is the usual victim. At least one path needs no login, and core alone cannot be exploited, but your modules and custom code can open the door.
If you run Drupal, update core and Entity List to the fixed releases today. If you cannot upgrade, uninstall the Field UI module, and move off any branch older than 10.6 or 11.3, which gets no fix.
The vendor handed out an early warning and a date. If the site still isn't patched, that's a choice, not bad luck.
Lior Aharonov · my takeSources
- BleepingComputer: Drupal patches critical RCE flaws, warns exploits may emerge soon bleepingcomputer.com
Researched with AI tools; every fact is checked against the linked sources.