Drupal has released patches for two critical vulnerabilities that could let attackers run malicious code remotely on websites built with any supported version of the open-source content management system. The flaws affect the Field UI module in Drupal's core software and the contributed Entity List module. The Drupal Security Team had issued an advance warning earlier in the week, telling administrators to set aside time for the updates because exploits could be developed within hours or days of disclosure.
The project disclosed this week that all currently supported versions of Drupal core are affected. According to the security advisory for CVE-2026-108097, the flaw cannot be exploited through Drupal core alone, but contributed modules can open multiple attack paths, including at least one that needs no authentication. Custom code may also expose the vulnerable functionality. Exploiting CVE-2026-108099 requires similar involvement of contributed modules or custom code and likewise includes at least one known path that does not require authentication.
Administrators are being directed to move Drupal core to version 10.6.19, 11.3.19, or 11.4.10, depending on their release branch, and to update Entity List to 3.0.10. The developer noted that all versions of Drupal prior to 10.6.x, along with all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. The flaws also affect Drupal 12 pre-releases before beta2, which are not intended for production use; the final stable 12.0 release will carry fixes for both issues.
For administrators unable to upgrade to a secure version, the project advises uninstalling the core Field UI module, field_ui, as an effective mitigation. Drupal Steward, the project's protection service, blocks some known attack vectors but does not cover every possible exploit. The security team had recommended that administrators update to the latest supported patch release for their version of Drupal before October 14 so that any other upgrade issues could be resolved ahead of the security window.
Drupal is a free, open-source content management system used to build and manage websites, and it is particularly popular among government agencies, universities, and non-profit organizations. According to the project's website, more than one million websites run on Drupal. The patches follow the project's earlier disclosure of both vulnerabilities and its warning that administrators should be ready to act quickly once fixes became available.
More cybersecurity news from TechManNews.
