Drupal patches two critical remote code execution flaws

Drupal has addressed two critical remote code execution vulnerabilities affecting all currently supported versions of its core software. The security team warns that functional exploits could emerge within hours or days. The two flaws are CVE-2026-108097 and CVE-2026-108099, with the former residing within Drupal's Field UI module and the latter in Entity List, a contributed module for creating entity lists without Views.

Both vulnerabilities can lead to arbitrary code execution on the server. However, neither bug poses an immediate threat to stock core, as both require third-party modules or custom code for exploitation. Drupal's advisory states that sites using custom code may also be at risk.

Given that most real-world deployments utilize multiple contributed modules, the absence of core exploitation does not provide significant reassurance. The recommended fix involves upgrading core to versions 10.6.19, 11.3.19, or 11.4.10, and updating Entity List to version 3.0.10. Any versions older than 10.6.x and any Drupal 11 releases prior to 11.3.x are considered end-of-life and will not receive a patch. Therefore, sites on these branches must migrate to a supported version before addressing the vulnerabilities.

Drupal 12 pre-releases, although affected, are not intended for production use, and the stable 12.0 release will incorporate the necessary patches. Drupal issued warnings prior to the update, urging administrators to allocate time for the upgrade, as exploits may be developed within hours or days. The project also advised upgrading to the latest bugfix release for the respective branch before October 14 to address any unrelated issues.

While Drupal Steward, a platform-level protection feature, blocks some known attack vectors, it does not guarantee complete security against all possible exploits. Users without the ability to upgrade within the designated window can uninstall the core Field UI module (field_ui) to mitigate the risk associated with CVE-2026-108097, though this action will remove the admin interface for managing fields, making it more suitable for sites in maintenance mode.