Drupal issued fixes for two critical remote‑code‑execution (a flaw that lets attackers run arbitrary code) flaws that affect every supported version of its CMS, releasing them on October 14, 2026.
CVE-2026-108097 (Common Vulnerabilities and Exposures identifier) affects the Drupal core Field UI module, while CVE-2026-108099 resides in the contributed Entity List module. Each flaw has at least one unauthenticated exploit route that uses contributed modules or custom code.
Any Drupal version prior to 10.6.x and any 11.x release before 11.3.x is now end‑of‑life and does not receive further security updates. If patching is not possible right away, administrators can remove the core Field UI module to reduce risk. Drupal Steward blocks several known attack paths for these vulnerabilities, though it does not stop every possible exploit.
Versions of Drupal 12 that come before the beta2 release are affected by the flaws but are not meant for live sites. Drupal 12.0’s final release will include fixes for both of these security issues.
The Drupal Security Team warned that functional exploits could emerge within hours or days of the disclosure. The project says that over a million websites are powered by Drupal.
Join the discussion