What happened

  • Drupal identified two critical vulnerabilities: CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module.
  • Both flaws could allow attackers to execute arbitrary code on affected servers, with at least one exploitation path that requires no authentication.
  • The advisory notes that the Field UI flaw cannot be exploited using core alone; contributed modules or custom code can create multiple attack vectors.
  • The Entity List flaw also relies on interaction with contributed modules or custom code for exploitation, and at least one known path does not need authentication.
  • The project warned that exploits might be developed within hours or days of disclosure, prompting an urgent call for updates.

Why it matters

  • Drupal powers more than one million websites, including many government, university and non-profit sites, according to the project’s website.
  • Successful exploitation could give attackers full control of a web server, leading to data theft, defacement or further compromise of connected systems.
  • The vulnerabilities affect all currently supported versions of Drupal core, meaning a large installed base is exposed.
  • The advisory recommends updating to Drupal core 10.6.19, 11.3.19 or 11.4.10, and to Entity List 3.0.10, before the October 14 security window closes.
  • For sites that cannot upgrade, uninstalling the core Field UI module is suggested as an effective mitigation measure.
  • The report also highlights that once attackers obtain valid credentials, only 37% of their actions are blocked, underscoring the need for defence in depth.

What this means for enterprise IT teams

  • Teams must schedule immediate updates to the specified Drupal core releases and the Entity List module, reserving time as the security team advised.
  • Legacy installations running versions prior to 10.6.x or 11.3.x are already end-of-life and receive no further security fixes, increasing risk exposure.
  • organisations should audit their module inventory, remove any unnecessary contributed modules, and ensure custom code does not expose the vulnerable functionality.
  • Monitoring for unauthorised activity is critical; the advisory notes that prevention scores drop sharply once attackers have valid credentials.
  • A rapid patching process reduces the window in which exploits could be weaponised, aligning with best practice for vulnerability management.
  • Enterprises that rely on Drupal for public-facing portals should also review their incident response plans, as the Blue Report 2026 shows that many attacks evade initial prevention layers.

In the words of Drupal Security Team: "The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days"

The bottom line

  • Apply the recommended patches without delay to close the RCE gaps.
  • Verify that all contributed modules are up to date and remove any unnecessary ones, such as the core Field UI module if it is not required.
  • Review security policies to ensure rapid response to future advisories, reducing the window of exposure.
  • Keep an eye on credential-based activity, as once attackers are inside, the chance of detection falls sharply.

Sources

  • bleepingcomputer.com