Drupal has patched two critical remote code execution vulnerabilities affecting every currently supported version of the open-source content management system, and its security team is urging administrators to update now, warning that working exploits could be developed within hours or days of disclosure.
The first flaw, tracked as CVE-2026-108097, is in Drupal core's Field UI module. Drupal says the vulnerability cannot be exploited with core alone, but contributed modules can open multiple exploitation paths, including at least one that requires no authentication at all. Custom code on a site can expose the same vulnerable functionality, which means a site's real risk depends heavily on what has been built on top of core.
The second flaw, CVE-2026-108099, affects Entity List, a contributed module used to create lists of entities without using Views. It follows a similar pattern: successful exploitation requires interaction with contributed modules or custom code, and Drupal says at least one known exploitation path also works without authentication. Together, the two flaws underline a familiar lesson for modular platforms: code execution risk often lives at the seams between core, add-ons and site-specific code.
Administrators should update Drupal core to version 10.6.19, 11.3.19 or 11.4.10, depending on their release branch, and update Entity List to version 3.0.10. Versions of Drupal before 10.6, and Drupal 11 versions before 11.3, are end-of-life and no longer supported, so sites still running them receive no fix at all. The flaws also affect Drupal 12 pre-releases before beta2, which are not intended for production use; the final stable Drupal 12.0 release will include fixes for both issues.
For teams that cannot upgrade immediately, Drupal recommends uninstalling the core Field UI module as an effective mitigation for the core flaw. Drupal Steward, the project's protective service, covers some known attack vectors, but Drupal is explicit that it does not cover every possible exploit, so it should be treated as a stopgap rather than a substitute for patching.
The stakes are not small. More than one million websites run on Drupal, according to the project, and the platform is particularly popular with government agencies, universities and nonprofit organizations, exactly the kind of sites that tend to hold sensitive records and face determined attackers. Drupal flagged the release window in advance at the start of the week, telling administrators to reserve time for core updates and to move to the latest patch release for their branch ahead of time, so unrelated upgrade problems would not slow the security fix.
For enterprise IT teams, the practical work is straightforward but urgent: inventory every Drupal site, including staging and forgotten departmental installs, check which branches and contributed modules are present, and patch or uninstall Field UI before exploit code circulates. With unauthenticated exploitation paths in play, this is not a patch to queue for the next maintenance window.