GoKawiilDrupal patches two critical RCE bugs in Field UI and Entity List modules
Drupal has released fixes for two critical remote-code-execution vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module, affecting all currently supported versions of the CMS. The project's security team urged administrators to update before October 14, warning that attackers could build exploits within hours or days of disclosure. Exploitation of either flaw generally requires interaction with contributed modules or custom code rather than core alone.
GoKawiil's interpretation of the reporting above, not reported fact.
Drupal powers over a million sites, including many government, university and non-profit websites, so unpatched instances could become attractive, high-value targets once exploit code circulates. The warning that exploits may appear 'within hours or days' suggests Drupal's security team expects rapid weaponization, making the patching window unusually urgent for administrators managing sites with contributed modules or custom code.
- Two critical RCE vulnerabilities (CVE-2026-108097 and CVE-2026-108099) affect all supported Drupal core versions.
- Drupal urged admins to update before October 14 ahead of a security disclosure window.
- Exploitation typically requires contributed modules or custom code, with at least one path needing no authentication.
Source: bleepingcomputer.com, 2026-10-17
Published there as: “Drupal patches critical RCE flaws, warns exploits may emerge soon”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.