Drupal has released patches for two critical remote code execution vulnerabilities affecting every currently supported version of the open-source content management system, which powers more than one million websites worldwide, including many government, education, and non-profit sites.

The flaws affect Drupal core’s Field UI module and the widely used contributed Entity List module. Ahead of disclosure, the Drupal Security Team issued an advance warning urging site administrators to set aside time for emergency updates, cautioning that working exploits could surface within hours or days of the advisory going public. The team also recommended updating to the latest bugfix release before the security window opened, so unrelated upgrade issues could be resolved beforehand.

The vulnerabilities

  • CVE-2026-108097: An RCE flaw in Drupal core’s Field UI module. It cannot be triggered through core alone, but contributed modules or custom code can expose exploitable paths, including at least one that requires no authentication.
  • CVE-2026-108099: An RCE flaw in Entity List, a contributed module used to build entity listings without Views. Exploitation likewise depends on interaction with contributed modules or custom code, and includes at least one unauthenticated attack path.

Both issues affect all currently supported Drupal core branches, as well as pre-release builds of Drupal 12 prior to beta2, though those builds are not intended for production use. Drupal confirmed the upcoming 12.0 stable release will ship with fixes included.

What administrators should do

Drupal is urging immediate upgrades to core versions 10.6.19, 11.3.19, or 11.4.10 depending on release branch, and updating the Entity List module to version 3.0.10. Notably, any Drupal installation running a version older than 10.6.x, or Drupal 11 builds prior to 11.3.x, is already end-of-life and unsupported, leaving those sites permanently exposed unless they upgrade to a maintained branch.

For sites that cannot immediately patch, Drupal recommends uninstalling the core Field UI module (field_ui) as a mitigation. The project also noted that its Drupal Steward service can block some known attack vectors, though it does not cover every possible exploitation path.

Given the project’s own warning that exploit development may follow quickly after disclosure, security teams managing Drupal deployments should treat this as a priority patching window rather than a routine update cycle.