Search

Drupal Patches Critical RCEs: CVE-2026-108097 & 108099

Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed modules or custom code , including at least one known path for each flaw that requires no authentication. Drupal issued an advance warning two days before disclosure, cautioning that exploit development could occur within hours or days after patches became public. What Are CVE-2026-108097 and CVE-2026-108099? The two vulnerabilities affect different Drupal components: • CVE-2026-108097: Remote code execution in Drupal core’s field_ui module.