Drupal Ships Patches for Critical RCE Flaws in Entity List and Field UI Modules

Drupal has released security updates addressing five vulnerabilities, including two critical-severity flaws that enable remote code execution. These patches target the Entity List module and the Field UI module within Drupal core, alongside several cross-site scripting defects.

What happened

The Entity List module, tracked as CVE-2026-108099, contains a critical flaw that is not exploitable by the module alone. However, Drupal notes that exploit paths exist when combined with other contributed modules. At least one known attack vector does not require authentication. Custom code may also expose the vulnerable functionality to attackers.

The Field UI module in Drupal core, identified as CVE-2026-108097, presents a similar risk profile. While core alone is not exploitable, contributed modules provide serious attack paths. At least one of these paths allows unauthenticated access. As a temporary mitigation, administrators can uninstall the core Field UI module.

Additional updates resolve cross-site scripting vulnerabilities in the Drupal core Link module, collectively tracked as CVE-2026-108515. An XSS flaw in the Navigation module is tracked as CVE-2026-108514. Patches are also available for a security defect in the Gin administration theme that could lead to XSS attacks.

Why it matters

Drupal urged users to reserve time for core updates on October 12, warning that exploits might be developed within hours or days. This timeline suggests a high urgency for patching efforts across affected installations. The vendor does not state that these vulnerabilities are currently being exploited in the wild.

What to watch

• Monitor Drupal’s security advisories page for additional details on the vulnerabilities.
• Check internal logs for signs of unauthorized access or unusual module activity.
• Verify that all contributed modules are compatible with the updated core versions.
• Review custom code for potential exposure to the vulnerable functionalities.

Who needs to act first

Teams should prioritize updating systems exposed to the internet or untrusted networks. Begin by isolating critical instances and applying patches in a staged manner. Test updates in a non-production environment to ensure compatibility with contributed modules. Back up configurations and data before rolling out changes. If immediate patching is not possible, consider disabling vulnerable modules temporarily to reduce exposure.

What to do and how to stay safe: Drupal

• Identify all instances running affected Drupal core versions or Entity List module.
• Apply the latest security updates to Drupal core and relevant contributed modules.
• Verify that custom code does not inadvertently expose vulnerable functionalities.
• Monitor system logs for indicators of compromise after patching.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Drupal versions are affected by the critical RCE flaws?

Drupal core versions 10.6, 11.3, and 11.4 are affected, requiring updates to 10.6.19, 11.3.19, and 11.4.10 respectively.

Is there a fix for the Entity List module vulnerability?

Yes, users should update to Entity List version 3.0.10 to address the critical flaw.

Are these vulnerabilities currently being exploited in the wild?

Drupal has not confirmed any active exploitation of these vulnerabilities in the wild.