Drupal users urged to patch critical RCE flaws and XSS bugs in latest core and module updates
Security updates address five vulnerabilities in Drupal core and modules, including two critical remote code execution bugs with known exploit paths.
Key points
- Patches released for Drupal 11.4.10, 11.3.19, and 10.6.19 address critical RCE flaws.
- Two critical bugs require specific contributed modules for exploitation.
- Additional fixes resolve XSS issues in Link, Navigation, and Gin modules.
Drupal has released security updates for versions 11.4.10, 11.3.19, and 10.6.19 to address five distinct vulnerabilities. The most severe issues are two critical-severity flaws that enable remote code execution. These bugs reside in the Entity List and Field UI modules. According to SecurityWeek, the vendor warned that exploits might be developed within hours or days of disclosure.
How it unfolded
- Drupal issued patches for five vulnerabilities, including two critical remote code execution flaws.
- The vendor warned users to reserve time for updates due to the rapid exploitation risk.
- Previous Drupal releases have reached end-of-life and do not receive these security updates.
Who is affected
The first critical flaw, CVE-2026-108099, affects the Entity List module. It is not exploitable with the module alone but becomes dangerous with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. The second critical flaw, CVE-2026-108097, impacts the Field UI module in Drupal core. It similarly requires contributed modules for exploitation, including paths that bypass authentication.
Additional patches address cross-site scripting issues. CVE-2026-108515 covers XSS holes in the Drupal core Link module. CVE-2026-108514 addresses an XSS flaw in the Navigation module. A separate security defect in the Gin administration theme is fixed in versions 5.0.16 and 4.1.4. Drupal notes that these vulnerabilities have not been confirmed as exploited in the wild.
Our take on the response
The vendor provided specific mitigation advice for the Field UI flaw. Users can uninstall the core Field UI module to reduce exposure immediately. This step is recommended while planning full updates. The vendor emphasized the urgency of applying patches to versions 11.4.10, 11.3.19, and 10.6.19. For the Entity List module, updating to version 3.0.10 is required.
Who needs to act first
Teams should prioritize systems exposed to the internet. Check whether servers run vulnerable Drupal versions. Verify if the Entity List or Field UI modules are installed. If uninstalling Field UI is possible, do so immediately. Back up all configurations before applying updates. Test patches in a staging environment first. Ensure monitoring tools alert on unusual administrative activity. Coordinate with development teams to review custom code for exposure.
What to do and how to stay safe: Drupal
- Verify current Drupal core and module versions against the patched releases.
- Uninstall the Field UI module if an immediate update cannot be deployed.
- Monitor server logs for unauthorized code execution or unusual authentication attempts.
- Review custom code and contributed modules for potential exploit paths.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Drupal versions are affected by the critical RCE flaws?
Drupal versions 11.4.10, 11.3.19, and 10.6.19 contain the fixes for the critical vulnerabilities.
Is there a workaround for the Field UI vulnerability?
Users can uninstall the core Field UI module as a mitigation measure until a full update is applied.
Are these vulnerabilities currently being exploited in the wild?
Drupal has not confirmed any active exploitation in the wild, but warned of rapid development of exploits.
