Drupal's security team has released fixes for a critical remote code execution vulnerability in the Field UI module that ships with Drupal core. It also fixed a separate critical remote code execution flaw in the contributed Entity List module, and it told site operators to expect working exploits soon. The core advisory, SA-CORE-2026-014, is dated October 14, 2026, and tracks the bug as CVE-2026-108097. The contributed-module advisory, SA-CONTRIB-2026-218, published the same day, covers CVE-2026-108099 in Entity List.

Every supported Drupal core branch is affected. Drupal has fixed the core flaw in 10.6.19, 11.3.19 and 11.4.10, and the Entity List flaw in Entity List 3.0.10. The sources reviewed for this story contain no reports of exploitation in the wild, and both advisories' risk vectors rate exploitability as "Theoretical." Even so, Drupal's pre-release announcement warned that exploits could appear within hours or days of the release, and BleepingComputer quoted the security team as saying "exploits might be developed within hours or days."

BleepingComputer, citing Drupal's own website, reports that more than one million websites run on Drupal. That means a large number of installations need patching on a short timeline.

What was fixed

The core issue is a remote code execution vulnerability in Field UI (field_ui). This is the administrative module site builders use to add and configure fields on content types and other entities. Drupal rates the issue Critical, 19 out of 25 on its own risk scale, with the vector AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default. In Drupal's scheme, that means:

  • AC:Basic: the access complexity is basic, so the flaw is not hard to trigger once a path to it exists.
  • A:None: no privilege level is required in the scored scenario.
  • CI:All / II:All: all non-public data could be exposed and all data could be modified or deleted.
  • E:Theoretical: at publication, exploitation was considered theoretical rather than demonstrated in public.
  • TD:Default: the vulnerable configuration is the default one, not an unusual setup.

The Entity List advisory carries the same rating, Critical 19/25, with an identical vector. Both advisories express severity on Drupal's own 25-point risk scale. Defenders who rely on CVSS-driven prioritization should use Drupal's rating directly rather than waiting for another score before acting.

Is a stock Drupal site exploitable?

Not through core alone, according to SA-CORE-2026-014. The advisory says the Field UI flaw is not directly exploitable with core by itself. However, contributed modules provide multiple serious exploit paths, and "at least one known exploit path does not require authentication." Custom code written by a site's own developers may also expose the vulnerable functionality. The Entity List advisory uses similar language: the flaw is not directly exploitable with the module alone, but other contributed modules create serious exploit paths, at least one of which requires no authentication.

This affects how operators should judge their own exposure. Few production Drupal sites run core with nothing added. Most use a mix of contributed modules and in-house code, so "not exploitable in core alone" gives little comfort unless you have checked every module and custom component that touches field handling.

Affected and fixed versions

The affected ranges below are copied from SA-CORE-2026-014:

  • 8.9.0 up to (not including) 10.6.19
  • 11.0.0 up to (not including) 11.3.19
  • 11.4.0 up to (not including) 11.4.10
  • 12.0.0-alpha1 up to (not including) 12.0.0-beta2

Fixed releases:

  • Drupal 11.4.10 for the 11.4.x branch
  • Drupal 11.3.19 for the 11.3.x branch
  • Drupal 10.6.19 for the 10.6.x branch
  • Entity List 3.0.10 for the contributed module (SA-CONTRIB-2026-218; all versions before 3.0.10 are affected)

Drupal 12 pre-releases before beta2 are affected. BleepingComputer notes these builds are not meant for production and reports that the final Drupal 12.0 release will include both fixes.

Sites on older branches have a bigger problem. The advisory notes that Drupal 11.2.x and earlier, 10.5.x and earlier, and Drupal 8 and 9 are end-of-life. If a site runs one of those versions, there is no patch for its branch. The fix requires moving to a supported release.

How the disclosure unfolded

  • October 12, 2026: Drupal published a public service announcement (PSA-2026-10-12) warning of a critical core release on October 14 between 16:00 and 21:00 UTC. The PSA said the issue scored 19 out of 25 and that exploits could appear within hours or days, and it withheld technical details until release.
  • October 14, 2026: SA-CORE-2026-014 was published with fixed core releases 10.6.19, 11.3.19 and 11.4.10. SA-CONTRIB-2026-218 covered Entity List 3.0.10.
  • October 17, 2026: BleepingComputer reported on both fixes and the security team's warning about rapid exploit development.

The PSA urged site owners to update to the latest patch release ahead of time and to reserve time during the security window for the core update. That advance notice matters because, once a patch is public, the window between release and exploitation can be short.

Interim mitigation and Drupal Steward

For sites that cannot update right away, the advisory suggests uninstalling the core Field UI module (field_ui) until the site is patched. Field UI is an administrative tool for building and changing field configuration. Operators should confirm in staging that no contributed module or custom code depends on it before removing it in production.

The advisory also says that sites using Drupal Steward have protection against some known attack vectors, but that "the protection offered will not cover all possible exploits." Steward subscribers should treat it as one extra layer of protection, not as a substitute for applying the update.

What It Means for Defenders

  • Update core now. Move to Drupal 10.6.19, 11.3.19 or 11.4.10, depending on your branch. If you are testing Drupal 12, move to 12.0.0-beta2 or later. Do not keep vulnerable alpha or early beta builds on internet-facing hosts.
  • Update Entity List. If the contributed Entity List module is installed, upgrade to 3.0.10 per SA-CONTRIB-2026-218.
  • Inventory your exposure. Neither flaw is directly exploitable by core or the module alone, so list every contributed module and custom module that interacts with fields or entity configuration. Look first at anything reachable by anonymous users, because at least one known path needs no authentication.
  • Uninstall Field UI if you cannot patch today. This is the vendor's documented interim mitigation. Verify the change in a staging environment first.
  • Plan to leave end-of-life branches. Sites on 11.2.x or earlier, 10.5.x or earlier, or Drupal 8 or 9 will receive no fix and should be scheduled for an upgrade to a supported branch.
  • Do not rely on a WAF alone. Drupal Steward and similar rules may block some attack paths but not all of them.
  • Watch for changes. The advisories list exploitability as theoretical, but Drupal expects that could change quickly. Monitor the drupal.org security advisory pages for updates. Check CISA's Known Exploited Vulnerabilities catalog for CVE-2026-108097 or CVE-2026-108099 in case either is added with a remediation due date. Review web server and application logs for unexpected requests to field configuration routes or unusual administrative changes.
  • If you suspect compromise, treat the host as untrusted. Rotate database and administrative credentials and any API keys stored in site configuration. Then review recently created accounts and changes to code or configuration.

Sources