Search
Find merged stories by title or summary.
Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication
Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026. The official security advisory, SA-CORE-2026-014, assigns the issue a risk score of 19 out of 25 under Drupal’s rating system. Successful exploitation could expose all private website data and allow attackers to change or delete information. The score is not a CVSS rating. The most important detail is that Drupal core alone does not provide a direct path to exploit the flaw. However, the security team confirmed that several serious attack paths exist when contributed modules are present. These are additional modules used to extend a website’s features beyond its core functions.
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed modules or custom code , including at least one known path for each flaw that requires no authentication. Drupal issued an advance warning two days before disclosure, cautioning that exploit development could occur within hours or days after patches became public. What Are CVE-2026-108097 and CVE-2026-108099? The two vulnerabilities affect different Drupal components: • CVE-2026-108097: Remote code execution in Drupal core’s field_ui module.
You've reached the end of current stories for this search.