Drupal Patches Critical RCE Vulnerabilities and Warns Exploits May Emerge Soon

569/69 Monday, October 19, 2026 Drupal, the developer of the open-source Content Management System (CMS), has released security updates to address two Critical Remote Code Execution (RCE) vulnerabilities that could allow attackers to execute commands on affected servers. The vulnerabilities involve the Field UI module, which is part of Drupal Core, and the Entity List module, a contributed module used to create entity listings without relying on Views. The Drupal Security Team issued an advance advisory on October 12, 2026, warning that attackers could potentially develop exploits within hours or days after technical details became public and urging website administrators to prepare to update their systems promptly. The first vulnerability, CVE-2026-108097, is an RCE flaw in the Field UI module of Drupal Core and affects all currently supported Drupal Core versions. Exploitation cannot be achieved through Drupal Core alone and requires interaction with a contributed module or custom code, with at least one known attack scenario not requiring authentication. The second vulnerability, CVE-2026-108099, is an RCE flaw in the Entity List module and can similarly be exploited in combination with contributed modules or custom code. At least one attack scenario also does not require authentication. Successful exploitation could allow attackers to take control of affected websites. Drupal recommends that administrators update Drupal Core to version 10.6.19, 11.3.19, or 11.4.10, depending on the branch in use, and update the Entity List module to version 3.0.10. Drupal versions earlier than 10.6.x and Drupal 11 versions earlier than 11.3.x are no longer supported. The vulnerabilities also affect pre-release Drupal 12 versions prior to Beta 2, while the stable Drupal 12.0 release will include the fixes. Organizations that cannot update immediately are advised to uninstall the Field UI module (field_ui ) to reduce exposure to that vulnerability. Drupal also noted that Drupal Steward can block some known attack patterns, but does not cover every possible exploitation method. Administrators should therefore review their installed versions and apply the available security updates as soon as possible.