**Drupal**, a widely-used free and open-source content management system (CMS), has issued critical security updates to address two significant vulnerabilities. These flaws could enable remote code execution (RCE) on websites running any supported version of the software. ### Urgent Call to Action Security teams have been vocal about the urgency of these updates, issuing an advance warning earlier in the week. The concern is that exploits could emerge rapidly following the public disclosure of the vulnerabilities. The **Drupal Security Team** explicitly urged administrators to "reserve time for core updates at that time because exploits might be developed within hours or days." Administrators were also advised to update to the latest supported patch release before October 14 to preemptively address any potential upgrade complications. ### Widespread Impact **Drupal** is a cornerstone for over a million websites globally, with a strong presence in government agencies, universities, and non-profit organizations. The disclosed vulnerabilities affect "all currently supported versions of Drupal core." ### The Vulnerabilities Detailed The two critical vulnerabilities are: * **CVE-2026-108097**: An RCE vulnerability identified in **Drupal** core’s **Field UI** module. This flaw could allow attackers to execute arbitrary code on affected servers. * **CVE-2026-108099**: A similar RCE flaw found in **Entity List**, a contributed module designed for creating entity lists without **Views**. For **CVE-2026-108097**, exploitation is not possible with **Drupal** core alone; however, contributed modules or custom code can provide multiple exploitation paths, including at least one that requires no authentication. The same interaction with contributed modules or custom code applies to **CVE-2026-108099**, also with at least one known unauthenticated exploitation path. ### Recommended Mitigations To secure their installations, administrators should update **Drupal** core to one of the following versions: * 10.6.19 * 11.3.19 * 11.4.10 Additionally, the **Entity List** module should be updated to version 3.0.10. It's important to note that **Drupal** versions prior to 10.6.x, and all versions of **Drupal** 11 prior to 11.3.x, are end-of-life and no longer receive support. While **Drupal** 12 pre-releases (before beta2) are also impacted, these are not intended for production environments. The final stable 12.0 version will include fixes for both flaws. As an alternative mitigation for those unable to upgrade immediately, uninstalling **Drupal**’s core **Field UI** module (`field_ui`) is an effective measure. While **Drupal Steward** offers protection against some known attack vectors, it does not cover every possible exploit scenario for these new vulnerabilities.