Drupal patches two critical remote code execution flaws

Drupal has patched two critical vulnerabilities that could allow remote code execution on websites running any supported version of the content management system. The flaws affect Drupal core’s Field UI module and the contributed Entity List module.

The project warned administrators to apply updates promptly, saying attackers might develop exploits within hours or days of disclosure. The advisory for CVE-2026-108097 says Drupal core alone cannot be used to exploit the flaw, but contributed modules or custom code can expose paths to exploitation, including one that requires no authentication. Exploiting CVE-2026-108099 also requires interaction with contributed modules or custom code; at least one known path does not require authentication.

Administrators should update Drupal core to version 10.6.19, 11.3.19, or 11.4.10, depending on their release branch, and update Entity List to 3.0.10. Versions before Drupal 10.6.x and Drupal 11.3.x are no longer supported. Drupal 12 pre-releases before beta2 are also affected, but are not intended for production; the project says the final stable 12.0 release will include fixes.

For systems that cannot be upgraded, Drupal says uninstalling the core Field UI module, field_ui, is an effective mitigation. Drupal Steward covers some known attack vectors but not every possible exploit.