# Drupal Patches Two Critical Remote Code Execution Flaws

> Drupal released urgent security updates on October 14, 2026, addressing two critical remote code execution vulnerabilities, one rated 19 out of 25 on its risk scale, that could allow attackers to run malicious code.

By PrimaryBrief newsroom · Published 2026-10-17T20:48:50.469779Z
Canonical: https://primarybrief.com/article/drupal-patches-two-critical-remote-code-execution-flaws-245d6255

On October 14, 2026, Drupal released urgent security updates addressing two critical Remote Code Execution (RCE) vulnerabilities and several moderately critical Cross-Site Scripting (XSS) flaws [1]. One RCE flaw, located in the core Field UI module, received a critical severity rating of 19 out of 25 on Drupal's risk calculator [1][3].

These vulnerabilities pose a significant threat because they could allow attackers to execute malicious code on affected Drupal websites, potentially leading to data breaches, website defacement, or complete system compromise [1][3][4]. The Drupal Security Team has warned that exploits for such severe flaws can emerge rapidly, making prompt updates necessary for all Drupal site administrators [1][3].

## What the records show

The Drupal Security Team's advisories detail two primary critical RCE vulnerabilities. The first, identified as SA-CORE-2026-014 (CVE-2026-108097), resides within the Field UI module, a standard component of Drupal core [1][4]. This flaw is not directly exploitable through Drupal core alone, but multiple serious exploit paths exist when combined with contributed modules, including at least one that does not require user authentication [1][4][5]. Custom code on a Drupal site could also expose this vulnerability [1]. The technical issue involves the Field UI's pre-render step processing tables by running PHP callables without proper verification [1]. Affected Drupal core versions include those from `8.9.0` up to `10.6.19`, `11.0.0` up to `11.3.19`, `11.4.0` up to `11.4.10`, and `12.0.0-alpha1` up to `12.0.0-beta2` [1]. Patched versions include Drupal 11.4.10, 11.3.19, and 10.6.19 [1][7]. Drupal 12.0.0-beta2 also includes fixes [1].

The second critical RCE, SA-CONTRIB-2026-218 (CVE-2026-108099), affects the contributed Entity List module, which allows users to create entity lists without using Views [1][15]. Similar to the Field UI vulnerability, this flaw is not directly exploitable by itself, but serious exploit paths can emerge when other contributed modules are present, with at least one known path not requiring authentication [1]. Affected Entity List module versions are those prior to `3.0.10` [1][12]. The fix is available in Entity List version 3.0.10, and this module requires a separate update from Drupal core [1].

For sites unable to apply updates immediately, uninstalling the core Field UI module (`field_ui`) serves as a temporary mitigation for SA-CORE-2026-014 [1][4]. This action disables administrative pages for managing fields but helps protect the site until a full update can be performed [1].

The update also addressed three moderately critical XSS vulnerabilities. These include SA-CORE-2026-015 (CVE-2026-108515) in the core Link module, rated 13/25, and SA-CORE-2026-016 (CVE-2026-108514) in the core Navigation module, rated 12/25 [1][22][24]. Both are due to insufficient sanitization and require specific user permissions for exploitation [1]. The third, SA-CONTRIB-2026-219 (CVE-2026-110738), impacts the contributed Gin Admin Theme, rated 13/25, also due to insufficient attribute sanitization and requiring specific permissions [1][20]. Updates for these XSS flaws are included in Drupal 11.4.10, 11.3.19, 10.6.19, and for Gin, versions 4.1.4 and 5.0.16 [1]. The Canadian Centre for Cyber Security reinforced the update guidance with bulletin AV26-1047 [1][33].

## The timeline

The Drupal Security Team pre-announced the critical core security release on October 12, 2026, through PSA-2026-10-12, advising users to prepare for updates [1][2][3][25]. The actual security updates were released on October 14, 2026, between 16:00 and 21:00 UTC [1][2][10]. As of October 15, 2026, no public exploit code or active attacks leveraging these specific vulnerabilities had been reported [1].

## What changed and for whom

Site administrators managing Drupal installations must update their systems to the patched versions to secure their websites [1]. Users running end-of-life versions, such as Drupal 11.2.x and below, 10.5.x and below, Drupal 8, and Drupal 9, will not receive security patches and are strongly advised to migrate to supported branches [1]. Even supported branches like 11.3.x and 10.6.x will lose security coverage in December 2026 [1]. While Drupal Steward offers some mitigation against known attack vectors for these flaws, the Drupal Security Team has stated that its protection is not comprehensive, emphasizing the importance of updating affected software [1].

## What the Drupal Security Team has said publicly

The Drupal Security Team warned that exploits for these vulnerabilities could surface quickly, within hours or days of the release, because of the severity rating of 19 out of 25 [1][3]. They advised users to allocate time for immediate updates [1]. The team also acknowledged Drew Webber and Octavio Galland for reporting CVE-2026-108097, and Lee Rowlands for reporting SA-CONTRIB-2026-218 [1].

## What we could not confirm

The full scope of the "multiple serious exploit paths" for the Field UI and Entity List RCE vulnerabilities, beyond the "at least one known path" not requiring authentication, remains unconfirmed in the public advisories [1][4].

## Evidence cited
1. Drupal patches critical RCE flaws, warns exploits may emerge soon (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
2. Prepare for the critical Drupal security release on 14 October 2026 with a practical inventory, testing, deployment and verification plan. The Drupal Security Team will publish a critical core security release for all supported branches on 14 October 2026 between 16:00 and 21:00 UTC. The pre-announced vulnerability is rated 19 out of 25, at the top of Drupal's Critical range, and the team warns that exploits could be developed within hours or days. For organisations in Sydney and Melbourne, the  (vanitech.com.au) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGJxtq1xRQ6rwi0wz1Ldwtk1__Qc3ZHf3VTC1PTjNWO1_Osd4ZBSH14EfTjcX3e8M7Oq3udARSM0zMbVjJ4FLdrpY0S2Y1oftyPGwfrFPXlSX0lrDIxBNaxrCGKcS1Mbh0-xoF-qeWVIh8fou_kauvjdfJG5ldULIxNqtywnPBS8DgyQW4XAynsRA==
3. On Wednesday, October 14, 2026, the Drupal Security Team will publish a critical security release for Drupal core. They rated it 19 out of 25 on their risk scale. That is high. Here is what their public service announcement (PSA-2026-10-12) tells us. The flaw needs no login to exploit, and it could let an attacker read or change private data on your site. Nobody has published an exploit yet. The Security Team expects one could show up within hours or days of the release, because attackers read t (drupalaid.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGg7mG6ppbff4Rj9gBjUP_MN38GLvH9QmPcqPibn840kzl9il3O4_kEjq0XJLHObq_03axCRBcc6TkqqNsWyO9ukBZr2dstIHXEKh0KdlTUCR6_erfqQN6NBhhkx_On8kPC8ZPXQv6VOEkMM6_HXJ2id_cl6x3sCsl8YE4I-Q0hefcmk_wF3W2mzLlJfF7KW0FZIE2zJA==
4. Drupal core - Critical - Remote code execution - SA-CORE-2026-014. ... A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. The vulnerability can be mitigated by uninstalling the core Field UI module ( field_ui ) (drupal.org) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFWXiAZDsP1UEfrPtZqcn654_pAO0ILIEByG49EzPgnhplXmAAmB1l8wHvrN2lP8JBdiiOd22jAFkEEWVbwkfTi5Gwu0qZQAq1SkmhPxzTs1STjDmcZ5z3nb7GAAsPG
5. Drupal core - Critical - Remote code execution - SA-CORE-2026-014. ... A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. The vulnerability can be mitigated by uninstalling the core Field UI module ( field_ui ) (drupal.org) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGmha_nUQefyXGnE1lCihLc9k96y2lJVFI9liwTUf2BAFfUEon96H2edPTi-HfP70Wh3ZaChRyPXf0X9nalfprkmZjkzKF0PkqBpeFMZ_9RqJ389p_xJuQVxI57ACD_-Jb0
6. Drupal fixes critical Field UI flaw with unauthenticated exploit path (cyberinsider.co.uk) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEBYxqVbLqwt8-9Lxs32-oSYwIzT0Zzk8uu56IGU9cLURPaqF_uR5wqzo1RWwtN4-Bkg8TwrFawctB99u1FlB6apmp1X_bUAH4ovCvqffb5_H7_bGS2bxL_tqnZ1u5GW9IVqh4acGz4G-LWZWbkgHb5v9n3MfuaMb2XozxRUJ7E_7TXcAqR2AHAMcaDhpP80qZahHSESoDh7vQDjQ==
7. Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules (thehackernews.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG87UAtxFAL6iRTHOT0z1PSk5eLf0c5X13KgfKqhNViM_6klrfAbJ4r34-hMaZqu7pTOpSLdlBTX5l-YPk9sAF3Iy4_tocSFMUQlLuLCE7JEs41VajNJQWHabDakopkj-gMXHfT3lvVDQowa8ihw3WN9adLAwMXxJnUCF7iyp2DyxYs1kc9Rg==
8. Drupal Security Advisories (drupal.org) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEtrlqTuTju--tR1ATDGkyDgyWg3rmHn-uFl-KMxXRoEFJDaKtRDzLQvQ1KIvzcSvhoxsW-QarPKVm5ue-g9QPYY-qMg7DuP9b-TbTW4GWPGZkM9UbcvhXTaw==
9. Drupal Patches Critical Field UI RCE Flaw, Warns Exploits May Emerge Soon (sec-news.ai) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQECFqKEcpYyMsbAZQ0F6sYc6LTOKNzXlejdCiELMO7mnBcNrDc3Hg_HUk8IMSLGaJFsJk-4JCe8z83DhfjU66pGsgFvOX_vNEBgjlOzf09nIrRioSRsX_cs8gkuT0ZnhUWA-o9ulABDPZuVAXrtL6u2ZUZfCkOenzQQSatOsA6unnfInaCaUICNS-dar-52vairghr_yWFrlnqC8
10. Critical Remote Code Execution and XSS Vulnerabilities Patched in Drupal (thedroptimes.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGOO3lQL3EQ9WeB8USvseVKCt0buqZrcxSTYSEEh1oPWBvsvbUblcpRFAU9BYzr6_MJ3Uvsith37i46JMkng1Zsm_BODs_00XUUxYvKlhlyAGR3t9i_z8UdwKisg83j-OqipgCtKQKLCiLJXWn2fZmNmlvUBStkWPXX9I5mY0QNTDoGVdEoJtxJFb6dbLGqmBEDpTCniTs=
11. Drupal Patches Critical Field UI RCE Flaw That Allows Unauthenticated Exploit Paths (honeynet.org.mx) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEmKZ00pvurbuReyFmMBbiilfVGn7P1h_NAlL0Auh6pPLteGCZKHMZtrgX0q90XiJmZfCHJgGikHN3zw5GB6I9pVXEEUwe33XdR_mUeGGLyPGZkM9UbcvhXTaw==
12. Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 - Drupalcenter.de (drupalcenter.de) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHcBBgeZvffdqIcHyAmv0gs864q0rsxgNp6HeGQaKlSVvCqZi5cFKWg-Jh_kkfCyejS3_dDiZou5WYsa2COYX8tkwhf5Q9y-VjLxjUmwi5oPY24to44Rix1xEN0RbhIJqueog6gTObW_uGmFcyT
13. Drupal Patches Critical Field UI RCE Flaw Reachable Through Contributed Modules (mallory.ai) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFZYt0VjOA0FoKXvhp0vW7zaq7iLL6th1AUOX8VYPud1HvTrb5jN3HIaq0nPBs70hY5kV5a4nq71WgT1EJaC2vVxWWN3CHI0jzxlsNujaF0ldK8RyddDSh93elOzakeuAKCmExHUUeEDEs6PKbL41T8W8du1ZCZC-1d
14. Drupal SA-CORE-2026-014: Field UI remote code execution. (adyog.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFH0kXDPU0VKK-bX7HkZCKVlmg9a_-H-e9WsSpIacudn69gZ-rEHI4QKrGHPNtm8uxDY_WcftirV2qghO19nD6Fs1lL60DNUvXDEpRyZ-_Wkd81HrAjfh_BbwvtvlxPqFo_e2DpihQgY2UWghYnr__dMFYTWGfI2Cjjk4j9P7_T
15. Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 | Drupal.org (drupal.org) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF47pnL2sackWN66ZCSajrXrGPOyTjkAAC0Pglgxqnc8aclzJMWlHjwPv3VR25GFRzH-2FhY2mupKBC3NqCnQ-HPFPKIvX-8fBDpbum_CX-pDClBrm0DKy1oWpOvD95lGJzy6Al
16. Drupal Security Advisories (drupal.org) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGisfkRpherVji4pdJeBz2Lh3lGF0a6GZlKqTWJqreIRj8FSLT8w70nV1HUxpQX6bXqT-m4T1V-a5cmf_q311ONLExYRg0amjL7gqm6h_jm52688J2--xRyoPD-C-tEMPfw5JNZuLK7oYX8myrg66VcA3H9rUo=
17. CVE-2026-108097: Critical RCE in Drupal Core’s Field UI Module - cveplayground.com (cveplayground.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHBnUkjR4PUDcVKrvtlSkhpO9Vm7HntY71_PVQKgdA_Eb_SpgP4pFIUnxs6BubSw9tMJ18Z8reOseyYhCgbFkV9MGiFSGYHm3g43DMZPUHsY69BgiYRLzzdBRy8hKL7NnQQdfGb3p0Xfs_GUVK9rZK25xykrUHK7V-JVl25ynZe65jP
18. Tenable® Security Advisory for Drupal core SA-CORE-2026-014 (tenable.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH1yr22AN4TWc_iLn-V7j2yWkhBvW_5XM1KCyUSGXmaENwIk9Pl6MLE86FuzbTY1-uzcdO2kK7nFZ9xgd_kqwtQVTlHT_1egeMgvwwpcxyA3fRP-RTtYv5SxhhSwNzOo5eLZumydQ==
19. Reddit - Dive into anything (reddit.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGc8sAOIKO_OBy9P-ZoA_83408Gb696aQU5FAOSSH0BQcjHlT8RUgjd6uMHFgC4jGBU8EAugn840X4eRCIAwf3qU0V-6ggMY8nakjciYmVwkomN_TRsJUhOUZljhKLw3wphMueUHLvjHl1BoLAxHIuN5ac68D_qt1ZOmCmn4Q7H32g4rdoLFLZRqyWARB-9d8crbman
20. SA-CONTRIB-2026-219: XSS (secalerts.co) — https://secalerts.co/vuln/SA-CONTRIB-2026-219
21. Critical Remote Code Execution and XSS Vulnerabilities Patched in Drupal (thedroptimes.com) — https://thedroptimes.com/news/critical-remote-code-execution-and-xss-vulnerabilities-patched-in-drupal
22. Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 (drupal.org) — https://www.drupal.org/security/advisory/sa-core-2026-015
23. Drupal core - Critical - Remote code execution - SA-CORE-2026-014 (drupal.org) — https://www.drupal.org/security/advisory/sa-core-2026-014
24. SA-CORE-2026-015: XSS (secalerts.co) — https://secalerts.co/vuln/SA-CORE-2026-015
25. Upcoming critical Drupal core release on October 14, 2026 - PSA-2026-10-12 (drupal.org) — https://www.drupal.org/psa-2026-10-12
26. Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules (thehackernews.com) — https://thehackernews.com/2026/10/drupal-patches-critical-field-ui-flaw.html
27. Drupal 11.3.7 | Drupal.org (drupal.org) — https://www.drupal.org/blog/drupal-11-3-7
28. Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 - Drupalcenter.de (drupalcenter.de) — https://www.drupalcenter.de/node/59489
29. Drupal 11.3.10 | Drupal.org (drupal.org) — https://www.drupal.org/blog/drupal-11-3-10
30. Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 (drupal.org) — https://www.drupal.org/security/advisory/sa-contrib-2026-218
31. Drupal Core Advisory: CVE-2026-9082 Affecting JSON:API Module (thedroptimes.com) — https://thedroptimes.com/news/drupal-core-advisory-cve-2026-9082-affecting-jsonapi-module
32. Drupal ECA Module Critical Vulnerability Allows RCE (sentinelone.com) — https://www.sentinelone.com/blog/drupal-eca-module-critical-vulnerability/
33. Drupal security advisory (AV26-1047) — Officially.News (officially.news) — https://officially.news/2026/10/15/drupal-security-advisory-av26-1047/
34. Drupal security advisory (AV26-1047) - Malware News (malware.news) — https://malware.news/t/drupal-security-advisory-av26-1047-canadian-centre-for-cyber-security/60751
35. What We Do - Canadian Centre for Cyber Security (cyber.gc.ca) — https://www.cyber.gc.ca/en/blogs/what-we-do
36. Drupal Security Advisory – 14th October 2026 (cirt.gy) — https://cirt.gy/current-advisories/drupal-security-advisory-14th-october-2026/
37. Drupal Core Security - 14 Oktober, 2026 - 19:25 (drupalcenter.de) — https://www.drupalcenter.de/node/59492
38. Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 (drupal.org) — https://www.drupal.org/security/advisory/sa-core-2026-016
39. Security Advisory: Drupal Field UI Module Critical RCE Vulnerability (CVE-2026-108097) - BitShield Bulletin (bitshieldbulletin.com) — https://bitshieldbulletin.com/security-advisory-drupal-field-ui-module-critical-rce-vulnerability-cve-2026-108097/
40. r/drupal - Critical RCE vulnerability in Field UI module : r/drupal (reddit.com) — https://www.reddit.com/r/drupal/comments/166v2n9/critical_rce_vulnerability_in_field_ui_module/
41. pm:uninstall (drush.org) — https://drush.org/commands/pm_uninstall
42. Remove field_ui and options from dependencies [#2926838] | Drupal.org (drupal.org) — https://www.drupal.org/node/2926838
43. Comment plugin does not exist | Drupal.org (drupal.org) — https://www.drupal.org/node/2959458
44. Drupal Critical Vulnerability Highlights Open-Source Software Risks - CXO Digital Pulse (cxodigitalpulse.com) — https://www.cxodigitalpulse.com/news/drupal-critical-vulnerability-highlights-open-source-software-risks/
45. Is Drupal secure? Overview of Drupal's security features (pantheon.io) — https://pantheon.io/docs/drupal-security
46. Understanding Drupal Security Advisories, Risk Scores, CVEs, and Drupal Steward (scantitan.com) — https://scantitan.com/blog/understanding-drupal-security-advisories-risk-scores-cves-and-drupal-steward
47. Weaponizing CVE-2026-9082: A Case Study in Rapid Exploit Development (f5.com) — https://www.f5.com/labs/articles/threat-intelligence/weaponizing-cve-2026-9082--a-case-study-in-rapid-exploit-development
48. Drupal Patches Critical SQL Injection Vulnerability, Active Exploitation Detected (securityweek.com) — https://www.securityweek.com/drupal-patches-critical-sql-injection-vulnerability-active-exploitation-detected/
49. Drupal Patches Critical Field UI RCE Flaw, Warns Exploits May Emerge Soon (sec-news.ai) — https://sec-news.ai/drupal-patches-critical-field-ui-rce-flaw-warns-exploits-may-emerge-soon/
50. Drupal Critical Security Release Announced for October 14 (thedroptimes.com) — https://thedroptimes.com/news/drupal-critical-security-release-announced-for-october-14
51. CISA Orders Feds To Patch Actively Exploited Drupal Vulnerability (gajshield.com) — https://gajshield.com/cisa-orders-feds-to-patch-actively-exploited-drupal-vulnerability/