Drupal patches critical RCE flaws, warns exploits may emerge soon

Drupal has patched two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. Both flaws could allow unauthenticated attackers to execute arbitrary code on affected servers, especially when combined with contributed or custom modules. The Drupal Security Team warns that exploits could emerge within hours or days of disclosure, urging immediate patching to versions 10.6.19, 11.3.19, 11.4.10, or Entity List 3.0.10.

AI-extracted · verify before operational use