Drupal patches critical remote code execution flaws in core and Entity List, warns exploits may follow fast

The Drupal Security Team has fixed two critical remote-code-execution flaws, one in Drupal core and one in a contributed module, and has warned that working exploits could appear "within hours or days." The core bug, CVE-2026-108097 in the Field UI module, was patched on 14 October 2026. Drupal cannot be attacked through core alone, but several contributed modules open a path, and at least one needs no login. As of 15 October no public exploit code or attacks had been reported, according to The Hacker News.

What happened

The core flaw is documented in advisory SA-CORE-2026-014 and rated 19 out of 25, which Drupal classes as critical. The fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19. Drupal 12.0.0-beta2 also contains the fix but is not meant for production, and 12.0.0-alpha1 through beta1 are affected.

A second advisory, SA-CONTRIB-2026-218 (CVE-2026-108099), covers the contributed Entity List module, with the same conditions, including a known no-login path. The fix is Entity List 3.0.10. Updating core does not update this module, so sites that use it need a separate step. The Entity List release notes say the fix mirrors the Field UI change, per the coverage we read. The Hacker News reports about 90 sites use the module.

Two lesser flaws were fixed in the same core releases: moderately critical cross-site scripting bugs in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which need at least a logged-in user.

Background

Drupal is a widely used open-source content management system. The security team announced on 12 October that a core release was coming on 14 October, and warned that exploits might be developed quickly once fixes are public. Reverse-engineering a patch is a standard route for attackers, and the gap between a fix being published and sites installing it is the dangerous window.

According to The Hacker News, the root cause sits in Field UI's table pre-render step, which passes each row's #region_callback to PHP's call_user_func_array without checking that the value is a safe callable. If an attacker can get a crafted value into that field, the server runs what the attacker chose. The report says the code goes back to at least Drupal 8.9.0 in 2020. The fix stops calling the callback and instead uses the row's region value, falling back to the table's hidden or first region. The flaw was reported by Drew Webber of the Drupal Security Team and Octavio Galland, per the same source.

The numbers

The Hacker News cites Drupal usage statistics for the week of 4 October: of 531,499 reporting sites, 151,442 (28.5%) were running a branch that is affected and has no fix, because it is end-of-life. The other 380,057 is our subtraction. Those figures count reporting sites only, and say nothing about how many are exposed through a vulnerable contributed module.

On an affected branch with no fix151442

Other reporting sites380057

Reporting Drupal sites by status, week of 4 October 2026 (sites)

	sites
On an affected branch with no fix	151442
Other reporting sites	380057

Source: Drupal usage statistics, as cited by The Hacker News

The end-of-life list is long: Drupal 11.2.x and earlier, 10.5.x and earlier, Drupal 9 and Drupal 8.9 are affected and receive no patch. Pantheon says Drupal 7, itself end-of-life on drupal.org, gets a backport in 7.107 through Tag1 Consulting's long-term support. A French advisory found by search says all versions since 8.9 are affected; this fits the 2020 origin above.

What it means

Exposure is conditional, which is not the same as safe. BleepingComputer notes that CVE-2026-108097 cannot be exploited through core alone; contributed modules or custom code are needed. The advisory, as relayed by The Hacker News, does not name the modules. A site owner therefore cannot rule out risk by reading the module list unless they know what each module does with Field UI forms. Treat any site with a public-facing contributed module as at risk until patched.

Patching has a small compatibility cost. Custom code that sets #region_callback on field_ui_table rows will no longer run it after the update, so test the "manage fields" and "manage display" pages. Pantheon's note on the Drupal 7 backport says the same change may affect custom code.

If you cannot update now, the Security Team says uninstalling the core field_ui module protects the site until you do. The cost is losing the manage fields and manage display pages; the Standard install profile includes this module. Drupal Steward, a protection program that Pantheon takes part in, blocks some known attack paths but not all, so it is not a substitute for updating.

End-of-life sites have no good option short of upgrading. 11.3.x and 10.6.x also lose security coverage in December 2026, per The Hacker News, so an upgrade to 11.4 or the 12.x line is the longer-term answer.

A practical checklist

Nothing below goes beyond what the advisories and coverage state; it is a way of ordering the steps.

1. Find your version. Sites on 11.4.x should move to 11.4.10, on 11.3.x to 11.3.19, and on 10.6.x to 10.6.19. Anything older is end-of-life and has no patch, so the first job is an upgrade, not a point release.
2. List contributed modules and custom code that touch forms or tables built on Field UI. Because the advisory does not name the exploit paths, assume any of them could matter.
3. Update Entity List separately to 3.0.10 if it is installed. Core updates do not cover it.
4. If an immediate update is impossible, uninstall field_ui, as the Security Team advises, and accept that the admin pages for managing fields and displays will be unavailable until you reinstall it after patching.
5. Look at your logs for unusual requests to the manage fields and manage display routes since 14 October. We found no published indicators of compromise, so this is general hygiene rather than a known signature.
6. Tell your host. Managed platforms such as Pantheon offer one-click core updates, per Pantheon's note, but you still have to run them.

The bigger lesson is the one security teams keep repeating: a vulnerability that needs "another module" is still a vulnerability, because real sites run dozens of them. A pre-announced release gives defenders a few days of notice; the same notice tells attackers when to start comparing code.

What we don't know yet

• Which modules give the no-login path. The advisory leaves them unnamed. We did not find a published list.
• Exploitation. None had been reported at the time of the sources we read. BleepingComputer's piece is dated 17 October; we did not find later confirmation either way.
• Primary advisory text. The drupal.org security pages would not load for us (a browser check blocked our fetch), so the details above come from BleepingComputer, The Hacker News, Pantheon and a search summary of the advisory. They agree on versions, dates and the CVE number.

What to watch next

Watch for a public proof of concept, since the Security Team expects one soon. Check whether your hosting provider has applied the update. If you run Entity List, update it separately to 3.0.10. Sites that cannot patch should apply the field_ui workaround today and plan the upgrade.

Update, 18 October 2026

We have now read the Drupal Security Team's advisory itself, SA-CORE-2026-014 (14 October 2026), and it confirms the details above. It rates CVE-2026-108097 critical, 19 out of 25. Affected are Drupal 8.9.0 up to (not including) 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, and 12.0.0-alpha1 up to 12.0.0-beta2. The flaw is "not directly exploitable with core alone", but contributed modules have exploit paths, at least one without authentication, and custom code may expose it too. Uninstalling the core Field UI module (field_ui) protects a site while it is updated. The advisory credits Drew Webber (mcdruid) of the Drupal Security Team and Octavio Galland.

Source: Drupal Security Team: SA-CORE-2026-014

Sources

• BleepingComputer: Drupal patches critical RCE flaws, warns exploits may emerge soon (17 Oct 2026)
• The Hacker News: Drupal patches critical core RCE flaw
• Pantheon: Drupal core security update (14 Oct 2026)
• Drupal Security Advisories (SA-CORE-2026-014, SA-CONTRIB-2026-218)