Drupal has rolled out patches for five vulnerabilities, including two critical-severity bugs that could be exploited for remote code execution (RCE).
The first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099. It is not exploitable with the module alone, but exploit paths exist with other contributed modules.
“At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality,” Drupal notes.
The second impacts the Field UI module in Drupal core and is tracked as CVE-2026-108097.
It is not exploitable with Drupal core alone, but contributed modules provide serious exploit paths, including at least one that does not require authentication. As a mitigation, users can uninstall the core Field UI module.
To address them, users are advised to update to Entity List version 3.0.10 and to Drupal versions 11.4.10, 11.3.19, or 10.6.19. Previous Drupal releases have reached end-of-life and no longer receive security updates.
The fresh Drupal updates also resolve cross-site scripting (XSS) holes in the Drupal core Link module (collectively tracked as CVE-2026-108515) and an XSS flaw in the Navigation module (CVE-2026-108514).
Additionally, Drupal announced patches for a security defect in the administration theme Gin that could lead to XSS attacks. Gin versions 5.0.16 and 4.1.4 contain fixes for the bug.
Drupal makes no mention of any of these vulnerabilities being exploited in the wild. On October 12, however, it urged users to reserve time for core updates, warning that “exploits might be developed within hours or days.”
Additional information can be found on Drupal’s security advisories page.
Related: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
Related: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Related: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Related: F5, Juniper Networks Patch Critical Vulnerabilities
