The Drupal Security Team has released fixes for two critical remote code execution vulnerabilities: CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. Both advisories were published on October 14 and rate the flaws critical, at 19 out of 25 on Drupal's own security risk scale.
The qualifications in those advisories are as important as the severity rating. Drupal says neither core Field UI nor Entity List is directly exploitable on its own. Serious exploit paths exist when other contributed modules or custom code expose the vulnerable functionality, and at least one known path requires no authentication. A site owner should therefore avoid assuming every installation is equally exposed, while also avoiding the opposite conclusion that the flaw is harmless because an extra component is involved.
What is affected?
The core issue affects supported Drupal branches before the relevant patched releases: 10.6.19, 11.3.19 and 11.4.10. The Entity List advisory covers versions earlier than 3.0.10 of that contributed module. Drupal 8 and 9, along with older Drupal 10 and 11 branches listed by the project, have reached end of life and do not receive the same security coverage. Administrators should check their exact core branch, installed modules and custom integrations rather than relying on a broad version label.
The Field UI vulnerability can be temporarily mitigated by uninstalling the field_ui core module while a site is updated, according to Drupal. The project says Drupal Steward protects some known attack vectors, but not necessarily every possible path. For Entity List, the advisory directs operators to upgrade to version 3.0.10. These mitigations and fixes should be considered against the site's actual module dependencies and deployment process.
Why prompt patching matters
Drupal issued an advance warning before the security release, saying exploits could be developed within hours or days after disclosure. That was a warning about possible future weaponization, not a confirmation of active exploitation. The advisories reviewed for this report do not establish that these two CVEs have been exploited in the wild.
For operators, the practical sequence is to inventory Drupal core versions and contributed modules, identify whether Field UI or Entity List is present, and apply the fixed releases listed in the core and Entity List advisories. Sites with custom code that connects to these components warrant a closer review of the reachable paths. A critical rating signals the potential impact of a successful exploit; the deployment's actual exposure depends on its configuration.