Drupal RCE vulnerabilities risk site takeovers, patch now

Both Drupal RCE vulnerabilities can let an attacker execute arbitrary code, which in practice means taking control of the server behind the site. Remote code execution is about as serious as web bugs get, because it turns a visitor into an operator.

The first, tracked as CVE-2026-108097, sits in Field UI. That is the core module site builders use to add and manage fields, such as a “price” box on a product page or a “department” box on a staff profile. The second, CVE-2026-108099, is in Entity List, a contributed (community-made, optional) module that lets builders create lists of content without using Drupal’s Views tool.

There is an important catch, and it cuts both ways. Drupal’s advisory says the Field UI flaw can’t be exploited with Drupal core alone. Other contributed modules, or a site’s own custom code, open the door, and they can offer several routes in. At least one known route for each bug works without the attacker logging in at all. So a plain core install is safer than it sounds, while a heavily customized site may be more exposed than its owner thinks.

Drupal says all currently supported versions of core were affected. Fixed versions came out on October 14 for the 10.6, 11.3 and 11.4 branches, and Entity List got its own fix in a new 3.0 release. Site owners should install the latest security release for whichever branch they run, then update Entity List if they use it.

Older sites are in a worse spot. Drupal says every version before 10.6, and every Drupal 11 version before 11.3, is end-of-life. Those releases get no fixes at all, so the only real answer is to upgrade to a supported branch.

Early test builds of Drupal 12 released before beta2 also carry both bugs. Those pre-releases aren’t meant for live websites, and the final stable 12.0 release will include both fixes.

If you can’t upgrade right away, uninstall the Field UI module (its machine name is field_ui). Drupal calls this an effective mitigation for the core flaw.

Sites covered by Drupal Steward get some extra protection. Drupal is clear that Steward blocks some known attack routes but not every possible exploit, so it is no substitute for the update.

Drupal also asked admins to get onto the latest bugfix release for their version before October 14. That way any routine upgrade problems could be cleared up early, leaving the security update itself for the day it landed.

If you look after a Drupal site, this is a patch-this-week job, not a someday job. A practical order of work looks like this:

• Check which Drupal branch your site runs.
• Apply the October 14 security release for that branch.
• Update Entity List if it is installed.
• If anything blocks the upgrade, uninstall Field UI until you can finish it.

If you only visit Drupal sites, there is nothing for you to install. The risk is that an unpatched site could be hijacked to steal what you type into it or to serve malware. Treat unexpected login prompts or strange downloads on familiar council, school or charity sites with suspicion, and report them to the organization.

So far the October fix seems to have done its job. By late October there were no public reports of either flaw being exploited in the wild, despite the early warnings.

Two weeks after the RCE fix, Drupal had a bigger problem. On October 28 it warned about CVE-2026-118539, a highly critical access bypass in the Commerce Core module, and said attackers were already exploiting it. Commerce Core adds shopping carts and checkout to Drupal and runs on more than 42,000 sites, including Fortune 500 companies and research universities.

The module didn’t properly protect certain routes and entity fields, which Drupal said “may financially impact the vendor.” Drupal scored the risk at 21 out of 25 and said unauthenticated attackers could abuse it however the module was set up. Store owners were told to update to the newest Commerce Core release on their branch and check their orders for anything odd. Drupal has not said how the bug is being used or how many shops were hit.

The same batch included 38 other advisories covering 21 contributed projects, with nearly a dozen rated critical. Some could lead to remote code execution or account takeover, and one could let Stripe-paid Commerce orders be marked as paid with no payment. This year has been busy for Drupal security: in May, attackers went after CVE-2026-9082, a SQL injection bug in core’s database layer that hit sites using PostgreSQL. Over the last several years, the US Cybersecurity and Infrastructure Security Agency has flagged 5 Drupal flaws as exploited in the wild.