DRUPAL has released patches for five vulnerabilities, including two critical-severity flaws that could enable remote code execution (RCE). The first is in the Entity List module, which allows users to create lists of entities without Views and is tracked as CVE-2026-108099. Drupal notes that, while not exploitable by the module alone, exploit paths exist when paired with contributed modules, and at least one known path does not require authentication.
The second critical issue affects the core Field UI module and is tracked as CVE-2026-108097; again, exploited paths exist via contributed modules, with at least one unauthenticated route. As a mitigation, users are advised to uninstall the core Field UI module.
Drupal’s advisory also addresses other fixes in the same release: XSS vulnerabilities in the core Link module (CVE-2026-108515) and in the Navigation module (CVE-2026-108514), alongside a security defect in the administration theme Gin, which affects versions 5.0.16 and 4.1.4 and has fixes in those respective variants.
The patches require upgrading to Entity List 3.0.10 and to Drupal versions 11.4.10, 11.3.19, or 10.6.19, noting that earlier Drupal releases have reached end-of-life and no longer receive security updates. Drupal states that it has not observed exploits in the wild, but warned on 12 October that exploits could be developed within hours or days.