Drupal patches two critical remote code execution flaws

Drupal has fixed two critical vulnerabilities that could let attackers run their own code on sites built with the popular open-source content management system. BleepingComputer reported the fixes on October 17, 2026, after Drupal's security team warned administrators earlier in the week to set time aside because exploits might appear within hours or days.

The first bug, CVE-2026-108097, is in the Field UI module that ships with Drupal core and affects every supported version. Drupal core alone cannot be exploited, but contributed modules or custom code can open a path to it, and at least one known path needs no login. The second, CVE-2026-108099, is in the contributed Entity List module and has a similar profile, again with at least one unauthenticated route.

Site owners should update Drupal core to 10.6.19, 11.3.19 or 11.4.10, depending on their branch, and Entity List to 3.0.10. Drupal 12 pre-releases before beta2 are also affected, and the stable 12.0 release will include the fixes. Versions older than 10.6 and early Drupal 11 releases are already end of life. If updating is not possible right away, Drupal suggests uninstalling the Field UI module. Drupal powers more than a million websites, many of them government, university and non-profit sites.

Why it matters

Unauthenticated code execution bugs in a widely used CMS tend to be exploited quickly, so Drupal sites should be patched now.

Source: BleepingComputer