Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Drupal has rolled out patches for five vulnerabilities, including two critical-severity bugs that could be exploited for remote code execution (RCE).
The first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099. It is not exploitable with the module alone, but exploit paths exist with other contributed modules.
“At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality,” Drupal notes.
The second impacts the Field UI module in Drupal core and is tracked as CVE-2026-108097.
It is not exploitable with Drupal core alone, but contributed modules provide serious exploit paths, including at least one that does not require authentication. As a mitigation, users can uninstall the core Field UI module.
To address them, users are advised to update to Entity List version 3.0.10 and to Drupal versions 11.4.10, 11.3.19, or...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
