On October 14, 2026, Drupal released urgent security updates addressing two critical Remote Code Execution (RCE) vulnerabilities and several moderately critical Cross-Site Scripting (XSS) flaws. One RCE flaw, located in the core Field UI module, received a critical severity rating of 19 out of 25 on Drupal's risk calculator.

These vulnerabilities pose a significant threat because they could allow attackers to execute malicious code on affected Drupal websites, potentially leading to data breaches, website defacement, or complete system compromise. The Drupal Security Team has warned that exploits for such severe flaws can emerge rapidly, making prompt updates necessary for all Drupal site administrators.

What the records show

The Drupal Security Team's advisories detail two primary critical RCE vulnerabilities. The first, identified as SA-CORE-2026-014 (CVE-2026-108097), resides within the Field UI module, a standard component of Drupal core. This flaw is not directly exploitable through Drupal core alone, but multiple serious exploit paths exist when combined with contributed modules, including at least one that does not require user authentication. Custom code on a Drupal site could also expose this vulnerability. The technical issue involves the Field UI's pre-render step processing tables by running PHP callables without proper verification. Affected Drupal core versions include those from 8.9.0 up to 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, and 12.0.0-alpha1 up to 12.0.0-beta2. Patched versions include Drupal 11.4.10, 11.3.19, and 10.6.19. Drupal 12.0.0-beta2 also includes fixes.

The second critical RCE, SA-CONTRIB-2026-218 (CVE-2026-108099), affects the contributed Entity List module, which allows users to create entity lists without using Views. Similar to the Field UI vulnerability, this flaw is not directly exploitable by itself, but serious exploit paths can emerge when other contributed modules are present, with at least one known path not requiring authentication. Affected Entity List module versions are those prior to 3.0.10. The fix is available in Entity List version 3.0.10, and this module requires a separate update from Drupal core.

For sites unable to apply updates immediately, uninstalling the core Field UI module (field_ui) serves as a temporary mitigation for SA-CORE-2026-014. This action disables administrative pages for managing fields but helps protect the site until a full update can be performed.

The update also addressed three moderately critical XSS vulnerabilities. These include SA-CORE-2026-015 (CVE-2026-108515) in the core Link module, rated 13/25, and SA-CORE-2026-016 (CVE-2026-108514) in the core Navigation module, rated 12/25. Both are due to insufficient sanitization and require specific user permissions for exploitation. The third, SA-CONTRIB-2026-219 (CVE-2026-110738), impacts the contributed Gin Admin Theme, rated 13/25, also due to insufficient attribute sanitization and requiring specific permissions. Updates for these XSS flaws are included in Drupal 11.4.10, 11.3.19, 10.6.19, and for Gin, versions 4.1.4 and 5.0.16. The Canadian Centre for Cyber Security reinforced the update guidance with bulletin AV26-1047.

The timeline

The Drupal Security Team pre-announced the critical core security release on October 12, 2026, through PSA-2026-10-12, advising users to prepare for updates. The actual security updates were released on October 14, 2026, between 16:00 and 21:00 UTC. As of October 15, 2026, no public exploit code or active attacks leveraging these specific vulnerabilities had been reported.

What changed and for whom

Site administrators managing Drupal installations must update their systems to the patched versions to secure their websites. Users running end-of-life versions, such as Drupal 11.2.x and below, 10.5.x and below, Drupal 8, and Drupal 9, will not receive security patches and are strongly advised to migrate to supported branches. Even supported branches like 11.3.x and 10.6.x will lose security coverage in December 2026. While Drupal Steward offers some mitigation against known attack vectors for these flaws, the Drupal Security Team has stated that its protection is not comprehensive, emphasizing the importance of updating affected software.

What the Drupal Security Team has said publicly

The Drupal Security Team warned that exploits for these vulnerabilities could surface quickly, within hours or days of the release, because of the severity rating of 19 out of 25. They advised users to allocate time for immediate updates. The team also acknowledged Drew Webber and Octavio Galland for reporting CVE-2026-108097, and Lee Rowlands for reporting SA-CONTRIB-2026-218.

What we could not confirm

The full scope of the "multiple serious exploit paths" for the Field UI and Entity List RCE vulnerabilities, beyond the "at least one known path" not requiring authentication, remains unconfirmed in the public advisories.