CriticalCVE
Drupal patches critical RCE flaws, warns exploits may emerge soon
BleepingComputer·Source published ·1 min read
What happened?
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]
Key details
- Drupal patched two critical remote code execution vulnerabilities in supported versions.
- The flaws affect the core Field UI module and the contributed Entity List module.
- Exploits may be developed within hours or days after disclosure.
- CVE-2026-108097 cannot be exploited with core alone but contributed modules provide paths including unauthenticated ones.
- CVE-2026-108099 also requires contributed modules or custom code and has an unauthenticated exploitation path.
- More than one million websites run on Drupal, including government and education sites.
- Drupal 12 pre-releases before beta2 are affected but not for production use.
Affected
- All currently supported versions of Drupal core are affected.
- Entity List module versions before 3.0.10 are affected.
- Drupal versions prior to 10.6.x and Drupal 11 prior to 11.3.x are end-of-life and unsupported.
- Drupal 12 pre-releases before beta2 are affected.
Fixes and mitigations
- Update Drupal core to 10.6.19, 11.3.19, or 11.4.10 depending on release branch.
- Update Entity List module to version 3.0.10.
- Uninstall the core Field UI module (field_ui) if unable to upgrade.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.