Drupal Patches Critical RCE Flaws, Warns of Fast Exploits

Drupal has released patches for five vulnerabilities, including two critical remote code execution (RCE) flaws in the Entity List and Field UI modules.

The Entity List flaw, tracked as CVE-2026-108099, affects functionality that creates entity lists without Drupal Views. The module alone does not provide an exploitation path, but other contributed modules can expose one. At least one known path does not require authentication, and custom code may expose the vulnerable functionality as well.

The second critical flaw affects Drupal core’s Field UI module and is tracked as CVE-2026-108097. Drupal core alone does not provide an attack path, but contributed modules can create conditions for exploitation. At least one known path does not require authentication. Administrators can uninstall Field UI as a temporary mitigation.

Users should update Entity List to version 3.0.10. Drupal core users should install version 11.4.10, 11.3.19 or 10.6.19. Earlier Drupal releases have reached end of life and no longer receive security updates.

The updates also fix cross-site scripting vulnerabilities in Drupal core’s Link module, tracked collectively as CVE-2026-108515, and an XSS flaw in the Navigation module, tracked as CVE-2026-108514. Drupal also patched a security defect in the Gin administration theme that could enable XSS attacks. The fixes are included in Gin versions 5.0.16 and 4.1.4.

Drupal has not reported exploitation of the vulnerabilities in the wild. In an Oct. 12 warning, the project said that “exploits might be developed within hours or days” and urged administrators to set aside time for core updates.