Drupal, the open-source software behind many government, university and nonprofit websites, has fixed two critical flaws that can let attackers run their own code on a site, and its security team had warned that working exploits could follow within hours or days, BleepingComputer reported Saturday. Because at least one known attack path requires no login, organizations that run Drupal sites have a short window to update.
What Happened
The more widespread flaw, tracked as CVE-2026-108097, sits in Field UI, a module that ships with Drupal core and lets administrators manage content fields. Drupal's security advisory SA-CORE-2026-014, dated Oct. 14, rates it Critical, with a score of 19 out of 25 on the project's risk scale. It is a remote code execution flaw, meaning an attacker could make the server run commands of the attacker's choosing.
Drupal core on its own cannot be attacked this way, the advisory says. But several add-on modules from the wider Drupal community create serious paths to exploit it, at least one of them without authentication, and a site's custom code may expose it too. The advisory does not describe the paths.
Affected releases run from version 8.9.0 up to the fixed versions 10.6.19, 11.3.19 and 11.4.10, plus Drupal 12 test releases before 12.0.0-beta2. BleepingComputer noted that the final stable Drupal 12.0 release will include fixes for both flaws.
The second flaw, CVE-2026-108099, affects Entity List, a community module for building lists of site content. Its advisory, SA-CONTRIB-2026-218, also scores it 19 out of 25 and says at least one known path needs no login. Version 3.0.10 fixes it.
The fixes did not arrive unannounced. In a public service announcement on Oct. 12, the Drupal Security Team told site owners to set aside time for a critical core release on Oct. 14 and cautioned that "exploits might be developed within hours or days."
Why It Matters
Drupal says more than 1 million websites run on its software, BleepingComputer reported, and it is especially popular with government agencies, universities and nonprofits. For leaders of those institutions, a flaw that can hand control of a public website to an outsider is a risk to their reputation, their data and their service to the public.
No exploitation has been reported. Still, the core advisory rates the flaw as needing only basic skill and no login to exploit, and Drupal warned site owners two days before the fixes shipped.
Sites that cannot upgrade right away can uninstall the Field UI module, which the core advisory says protects them while they update. Sites enrolled in Drupal Steward have some protection against known attack methods, but not against every possible exploit, so the advisory says they should still upgrade soon.
Context
Older Drupal sites face a harder choice. Drupal 8 and 9, versions 10.5.x and earlier, and versions 11.2.x and earlier are end-of-life and receive no security fixes, according to the advisory. Organizations on those versions must move to a supported release before they can apply this patch.
What to Watch
- Publication of proof-of-concept attack code showing how to exploit either flaw.
- Whether the Cybersecurity and Infrastructure Security Agency adds either flaw to its catalog of known exploited vulnerabilities, a signal that attacks are underway.
- Reports of mass scanning for vulnerable Drupal sites, and whether Drupal discloses more attack paths through other modules.
