Full Report
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]
Analysis Summary
# Vulnerability: Drupal Core Field UI and Entity List Remote Code Execution (Two Critical Flaws)
## CVE Details
- CVE ID: CVE-2026-108097 (Drupal core, Field UI module); CVE-2026-108099 (contributed module Entity List)
- CVSS Score: Not provided in the article. Described as "critical." Verify scores in the Drupal security advisories.
- CWE: Not provided in the article.
## Affected Systems
- Products:
- Drupal core (Field UI module, `field_ui`)
- Entity List contributed module (version 3.0.10 is the fixed release)
- Versions:
- CVE-2026-108097: "All currently supported versions of Drupal core are affected." Drupal 12 pre-releases before beta2 are also affected.
- CVE-2026-108099: Entity List versions before 3.0.10 (exact affected range not stated in the article)
- Configurations:
- CVE-2026-108097 cannot be exploited through Drupal core alone. Exploitation depends on contributed modules or custom code that expose the vulnerable functionality.
- CVE-2026-108099 similarly requires interaction with contributed modules or custom code.
- Sites that do not use Entity List, or that have no custom code exposing the affected functionality, may have reduced exposure. The article does not confirm this, so verify against the advisories.
## Vulnerability Description
The article does not provide technical root-cause details. Per the summary:
- **CVE-2026-108097** is a remote code execution flaw in Drupal core's Field UI module that could allow arbitrary code execution on affected servers.
- **CVE-2026-108099** is a flaw in Entity List, a contributed module for building entity lists without Views, that could enable remote code execution.
Both flaws become exploitable through contributed modules or custom code. The article notes that multiple exploitation paths exist, including at least one that requires no authentication.
## Exploitation
- Status: **No confirmed in-the-wild exploitation reported.** The article states that "at least one known exploitation path" exists for each vulnerability that does not require authentication. It is unclear whether this is a public PoC. Drupal warns that "exploits might be developed within hours or days." Treat PoC development as likely.
- Complexity: Not stated. Medium is a reasonable assessment, since exploitation depends on specific contributed modules or custom code. One path reportedly requires no authentication, which lowers the barrier.
- Attack Vector: Network (remote code execution over HTTP against a web-facing Drupal site)
## Impact
- Confidentiality: High (implied by remote code execution; not explicitly stated)
- Integrity: High (implied by remote code execution; not explicitly stated)
- Availability: High (implied by remote code execution; not explicitly stated)
## Remediation
### Patches
- Drupal core:
- 10.6.19 (Drupal 10.6.x branch)
- 11.3.19 (Drupal 11.3.x branch)
- 11.4.10 (Drupal 11.4.x branch)
- Entity List module: 3.0.10
- Drupal 12: Fixes will be included in the final stable 12.0 release. Pre-release versions before beta2 are affected and should not be used in production.
- Drupal's security team recommends applying the latest supported patch release before October 14, 2026.
- Versions of Drupal prior to 10.6.x and 11.3.x are end-of-life and receive no patches. Sites on those versions must upgrade to a supported branch.
### Workarounds
- If you cannot upgrade immediately, uninstall the core Field UI module (`field_ui`). The article describes this as an effective mitigation.
- Drupal Steward offers some protection against known attack vectors but does not cover every possible exploit. Do not rely on it as a substitute for patching.
- Review contributed modules and custom code for functionality that exposes Field UI or Entity List behavior, and restrict access where possible.
## Detection
- Indicators of compromise: The article does not list specific IOCs. Monitor for:
- Unexpected requests to Field UI administrative routes or Entity List endpoints, particularly from unauthenticated sources
- Unexpected PHP or script files in web-accessible directories
- New or modified Drupal configuration, user accounts, or cron jobs
- Unusual outbound connections or process execution from the web server user
- Detection methods and tools:
- Review web server access logs for anomalous POST requests to Drupal endpoints
- Check installed module versions (for example, with `drush pm:list`) to confirm whether Entity List is below 3.0.10 and core is below the patched versions
- Compare file integrity against a known-good baseline
- Consult Drupal's advisories for any published detection signatures
## References
- Drupal security advisory for CVE-2026-108097 (core): hxxps://www.drupal[.]org/sa-core-2026-014
- Drupal security advisory for CVE-2026-108099 (Entity List): hxxps://www.drupal[.]org/sa-contrib-2026-218
- Drupal Security Team public service announcement: hxxp://www.drupal[.]org/psa-2026-10-12
- Drupal project overview: hxxp://www.drupal[.]org/what-is-drupal
- BleepingComputer article (source): hxxps://www.bleepingcomputer[.]com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/