Drupal Patches Critical RCEs: CVE-2026-108097 & 108099
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module.
The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed modules or custom code, including at least one known path for each flaw that requires no authentication.
Drupal issued an advance warning two days before disclosure, cautioning that exploit development could occur within hours or days after patches became public.
What Are CVE-2026-108097 and CVE-2026-108099?
The two vulnerabilities affect different Drupal components:
- CVE-2026-108097: Remote code execution in Drupal core’s field_ui module.
- CVE-2026-108099: Remote code execution affecting the contributed Entity List module, which creates lists of Drupal entities without relying on Views.
Drupal rates both flaws Critical at 19/25 using its own security risk scoring system. This is not a CVSS score; Drupal’s rating considers factors such as access complexity, authentication requirements, confidentiality and integrity impact, exploit availability, and deployment prevalence.
The advisories confirm that exploitation depends on contributed modules or custom code exposing the vulnerable functionality, but they do not disclose the complete root cause, vulnerable request sequence, or every affected integration.
Which Drupal Versions Are Affected?
| Component | Affected Versions | Fixed Version |
|---|---|---|
| Drupal core | 8.9.0 to <10.6.19 | 10.6.19 |
| Drupal core | 11.0.0 to <11.3.19 | 11.3.19 |
| Drupal core | 11.4.0 to <11.4.10 | 11.4.10 |
| Drupal 12 pre-release | 12.0.0-alpha1 to <12.0.0-beta2 | 12.0.0-beta2 |
| Entity List | Below 3.0.10 | 3.0.10 |
Drupal emphasizes that supported production branches are 10.6.x, 11.3.x, and 11.4.x. Older Drupal 10 and 11 branches, as well as Drupal 8 and 9, are end-of-life and do not receive normal security coverage.
Installing Field UI or Entity List alone does not prove a site is exploitable. A contributed module or custom implementation must expose the vulnerable functionality.
How Could the Drupal RCEs Be Exploited?
At a high level, an attacker would need to reach an exposed route or integration that passes attacker-controlled data into vulnerable Field UI or Entity List functionality.
If the necessary integration exists, Drupal says multiple serious paths can lead to remote code execution. At least one known path for each issue is accessible without authentication.
Successful code execution would normally occur with the privileges assigned to the PHP or web server process. From there, potential consequences could include application data theft, website modification, webshell installation, credential or token exposure, and attempts to reach connected systems.
Those are consequences of successful server-side code execution, not evidence of attacks already observed against these CVEs.
Is There Active Exploitation?
No confirmed in-the-wild exploitation was identified as of October 19, 2026.
Drupal currently marks exploit availability for both advisories as E, meaning its risk model does not identify public exploit code or documented exploit development.
The Drupal Security Team’s October 12 warning that exploits could emerge within hours or days was a prediction about likely exploit development; not confirmation that attacks had begun.
Monitor Drupal RCE Risk with SOCRadar
As exploit development evolves, teams need visibility into both threat activity and exposed Drupal assets. Relevant SOCRadar capabilities include:
- Cyber Threat Intelligence: Track exploit reports, threat activity, and changing exploitation status.
- Vulnerability Intelligence: Monitor affected versions, remediation updates, and exploit availability.
- Attack Surface Management: Identify internet-facing Drupal assets that may still be vulnerable.
- Dark Web Monitoring: Watch for exploit claims, access sales, and underground discussion around the CVEs.
Together, these capabilities help teams prioritize exposed systems as the threat landscape changes.
What Should Defenders Do?
Patch Affected Drupal Sites
Update Drupal core to 10.6.19, 11.3.19, 11.4.10, or 12.0.0-beta2, depending on the branch. Upgrade Entity List to 3.0.10 or later.
End-of-life installations should migrate to a supported Drupal branch rather than relying on an isolated patch.
Use the Field UI Mitigation If Necessary
If CVE-2026-108097 cannot be patched immediately, Drupal recommends uninstalling the core Field UI (field_ui) module until the update can be deployed.
Drupal Steward protects against some known attack vectors, but Drupal explicitly warns that it does not cover every possible exploit path and should not replace upgrading.
Review Integrations and Hunt for Suspicious Activity
Inventory enabled contributed modules and custom code that interact with Field UI, entity lists, fields, rendering, or display configuration.
Review web server, WAF, and application logs for unusual requests to those integrations, particularly from October 14 onward. On the host, look for unexpected PHP or web server child processes, newly created PHP files, modified web content, unusual scheduled tasks, unexpected Drupal administrator changes, and suspicious outbound connections.
Internet-facing systems that remained unpatched after disclosure should receive the highest remediation and post-exploitation review priority.
