Organizations Face Urgent Risk as Critical Drupal RCE Flaws Demand Immediate Patching Ahead of Imminent Exploits

Drupal has released patches for two critical vulnerabilities that enable remote code execution on websites running any currently supported version of its content management system. The flaws affect the core Field UI module and the contributed Entity List module. According to BleepingComputer, the project issued an advance warning urging administrators to apply updates promptly because attackers could develop working exploits shortly after the public disclosure of these security issues.

The risk

The first vulnerability, tracked as CVE-2026-108097, resides in Drupal core’s Field UI module and allows attackers to execute arbitrary code on affected servers. The second flaw, CVE-2026-108099, is found in the Entity List module, which helps users create entity lists without using Views. Both issues can lead to full remote code execution. The Drupal Security Team warned that exploits might be developed within hours or days of the advisory release, creating a narrow window for administrators to secure their infrastructure before active attacks begin.

Who is exposed

All currently supported versions of Drupal core are affected by these security issues, according to the project’s official disclosure. This includes the 10.6, 11.3, and 11.4 release branches. The Drupal project noted that more than one million websites run on this platform, with significant adoption among government agencies, universities, and non-profit organizations. Organizations running older versions, specifically those prior to 10.6.x or 11.3.x, are end-of-life and no longer receive security support, leaving them permanently exposed to these and future threats.

Cost and compliance

Successful exploitation of either vulnerability requires interaction with contributed modules or custom code, not just Drupal core alone. However, the security advisory for CVE-2026-108097 notes that at least one exploitation path requires no authentication. Similarly, CVE-2026-108099 includes a known exploitation path that does not require authentication. This unauthenticated access potential significantly raises the risk profile for automated scanning and large-scale attacks, potentially leading to unauthorized data access or system compromise without prior credential theft.

What happens next

Administrators must update Drupal core to version 10.6.19, 11.3.19, or 11.4.10 depending on their current release branch. They must also update the Entity List module to version 3.0.10. The Drupal Security Team recommends completing these updates before October 14 to allow time to address any other upgrade issues that might arise during the security window. Delaying these updates increases the likelihood of encountering active exploitation attempts in the immediate future.

Questions to ask your suppliers

Organizations should determine which third-party vendors host their public-facing websites and whether those vendors have confirmed application of the latest Drupal patches. Ask IT teams to verify if any custom code interacts with the Field UI or Entity List modules, as custom interactions can create new exploitation paths. Confirm that end-of-life Drupal versions have been migrated to supported releases. Identify who holds administrative access to these platforms and ensure that change management procedures allow for rapid emergency updates when critical vulnerabilities are disclosed without prior warning.

What to do and how to stay safe

• Inventory all systems running Drupal to identify versions currently in support versus those that are end-of-life.
• Apply the latest patch releases for Drupal core and the Entity List module immediately, prioritizing public-facing sites.
• Audit custom code and contributed modules for interactions with the Field UI module to reduce potential exploitation paths.
• Monitor server logs for unusual activity or unauthorized code execution attempts following the disclosure date.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific Drupal versions are affected by these vulnerabilities?

All currently supported versions of Drupal core are affected, including 10.6.x, 11.3.x, and 11.4.x.

Do the exploits require the attacker to log in first?

No, at least one known exploitation path for both vulnerabilities does not require authentication.

What versions should administrators update to for a fix?

Administrators should update to core versions 10.6.19, 11.3.19, or 11.