Drupal patches critical remote code execution flaws in core and a contributed module

TLDR

• Drupal published advisory SA-CORE-2026-014 for CVE-2026-108097, a critical remote code execution flaw in core's Field UI module.¹
• Patched releases are Drupal 10.6.19, 11.3.19 and 11.4.10, and removing the Field UI module is the stopgap.¹
• BleepingComputer reports a second critical flaw, CVE-2026-108099, in the contributed Entity List module, fixed in 3.0.10.³

Drupal published the advisory on 14 October and rates the flaw critical at 19 out of 25. It says the flaw cannot be exploited with core alone, but that multiple serious exploit paths exist through contributed modules, at least one of which needs no authentication, and that custom code may also expose it.¹

Drupal's advisory lists affected versions as 8.9.0 up to but not including 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, and 12.0.0-alpha1 up to 12.0.0-beta2.¹ It says Drupal 11.2.x and below, Drupal 10.5.x and below, and Drupal 8 and 9 are end-of-life and receive no security coverage, and that sites protected by Drupal Steward are covered against some known attack vectors but should still upgrade.¹ BleepingComputer adds that Drupal issued an advance warning earlier in the week asking administrators to reserve time for core updates, and that the Drupal 12 pre-releases affected are not meant for production.³

BleepingComputer says exploitation of CVE-2026-108099 needs a similar interaction with contributed modules or custom code and includes at least one known path that needs no authentication.³ The Drupal.org advisory read for this piece covers only CVE-2026-108097, so the Entity List details rest on BleepingComputer alone.¹³ NHS England Digital's alert, published on 16 October, says successful exploitation of CVE-2026-108097 could allow an unauthenticated attacker to perform remote code execution, and lists its own threat severity as "Medium".² None of the three sources reports exploitation in the wild.

Why it matters: Drupal says more than one million websites run on it, with heavy use by government agencies, universities and non-profits according to BleepingComputer, and the project's own warning that exploits could follow within hours or days of disclosure makes the patch window short.³