Drupal has released fixes for two critical remote code execution vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module, and warned that exploits might be developed within hours or days. The advisories and patched releases were published around October 15 and 16, and BleepingComputer reported the flaws on October 17.
Drupal Advisory Covers CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List
Both vulnerabilities are rated critical and allow remote code execution. CVE-2026-108097 sits in the Field UI module in Drupal core. It cannot be exploited with core alone, but contributed modules provide multiple exploitation paths, including at least one that requires no authentication. Custom code may also expose it.
CVE-2026-108099 affects the contributed Entity List module and needs similar interaction with contributed modules or custom code. It also has at least one known unauthenticated path.
Drupal gave advance warning earlier in the week. It urged administrators to reserve time for core updates because “exploits might be developed within hours or days.” The early notice came in a security-window announcement the week of October 12, which recommended updating to the latest bugfix release before October 14.
Affected Versions and the Drupal 12 Pre-Release Exposure
All supported Drupal core versions are affected. Drupal 12 pre-releases before beta2 are also vulnerable, and the stable 12.0 release will include the fixes. Drupal is used on more than one million sites and is popular with governments, universities and non-profits, so the potential population of exposed sites is large.
Patched Releases and the Field UI Workaround
Administrators should update core to the release matching their branch: 10.6.19, 11.3.19 or 11.4.10. The Entity List module should be updated to 3.0.10. Versions older than 10.6.x and 11.3.x are end-of-life and receive no patch, which leaves sites on those branches with a migration decision rather than a quick update.
For sites that cannot update immediately, Drupal lists a workaround for CVE-2026-108097: uninstall the core Field UI module. Drupal Steward, the project’s protection service, covers some known exploitation vectors but not all, so it is not a substitute for patching.
Why the Contributed-Module Dependency Complicates Risk Assessment
The advisory structure makes the risk harder to size than a typical core flaw. Because CVE-2026-108097 cannot be exploited on a core-only install, a site’s exposure depends on which contributed modules and custom code it runs. At least one of the known paths needs no authentication, which means a site that looks safe in a core-only review may still be reachable.
Drupal’s own phrasing, that exploits could appear within hours or days, reflects how quickly patch diffs are reverse-engineered once releases are public. No exploitation of these two flaws has been reported in the sources reviewed.
What Site Owners Should Check First
The fastest triage is to identify the branch each site runs. Sites on 10.6.x, 11.3.x or 11.4.x should move to the fixed releases listed above. Sites on older end-of-life branches cannot be patched and should either upgrade to a supported branch or remove the Field UI module as a stopgap while planning that move.
Teams that run the Entity List module need a separate update, since the module fix ships independently of core. Organizations with many Drupal instances, such as universities and public agencies, face a longer inventory task, and the warning window Drupal described leaves little time to complete it before working exploit code becomes available to attackers.
Administrators who followed the advance warning and prepared a maintenance window can move quickly, while those who learned of the flaws from news coverage on October 17 are starting later. Since the project’s own wording is that exploits might be developed within hours or days, the order of work is to patch internet-facing sites first, then apply the Field UI workaround to anything that cannot be updated the same day.
