Drupal shipped fixes for two critical remote code execution bugs and warned that exploits “might be developed within hours or days.” If you run Drupal, this one’s not a wait-until-next-month patch.
The bugs
- CVE-2026-108097: RCE in Drupal core’s Field UI module. Not exploitable with core alone, but contributed modules provide multiple paths, including at least one that needs no authentication. Custom code can expose it too.
- CVE-2026-108099: RCE in the contributed Entity List module, also with at least one known unauthenticated path.
All supported Drupal core versions are affected, plus Drupal 12 pre-releases before beta2.
What to do
- Update core to 10.6.19, 11.3.19 or 11.4.10 depending on your branch, and Entity List to 3.0.10.
- Can’t upgrade yet? Uninstall the core Field UI module (field_ui) as a mitigation.
- Anything older than 10.6.x or 11.3.x is end-of-life. Time to move.
