DRUPAL has patched two critical remote code execution vulnerabilities—CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. The advisories make clear that neither flaw is directly exploitable through the affected component alone; instead, exploit chains exist via contributed modules or custom code, with at least one known path for each issue that does not require authentication. Drupal issued an advance warning before disclosure, noting that exploit development could begin within hours or days of patches becoming public.
Affected versions include Drupal core 8.9.0 to less than 10.6.19, 11.0.0 to less than 11.3.19, 11.4.0 to less than 11.4.10, and 12 pre-release builds up to 12.0.0-beta2, with fixes to 10.6.19, 11.3.19, 11.4.10 and 12.0.0-beta2 respectively; for Entity List, below 3.0.10 is addressed by 3.0.10. Drupal emphasises that supported production branches are 10.6.x, 11.3.x and 11.4.x, while older 10/11 branches and Drupal 8/9 are end-of-life.
Exploitation would let an attacker execute code with the web server or PHP process privileges, enabling data theft, site modification, webshells, credential exposure and further compromise. As of 19 October 2026, no confirmed in-the-wild exploitation had been identified, and Drupal’s exploit availability remains marked as E.
Defenders are urged to patch or, if immediate patching is not possible, to disable Field UI temporarily, review integrations, and monitor for suspicious activity on exposed routes and related modules.