Drupal Critical RCE Fixes: Patch CVE-2026-108097 and Entity List CVE-2026-108099 Now

Because working exploits could be engineered within hours or days of the public disclosure, system administrators running Drupal on Windows Server IIS, Linux, Azure App Service, or containerized enterprise environments need to treat this patch cycle as an immediate priority. What makes this advisory particularly tricky for SecOps teams is how the vulnerabilities operate: neither flaw is directly exploitable in an isolated, bare-bones installation, yet both become reachable—and potentially exploitable without any user authentication—once paired with certain contributed modules or custom code.

The Anatomy of the Flaws: Core Meets Contributed Code​

According to reporting from BleepingComputer and official advisories published by the Drupal Security Team, the October 14 security window addressed two distinct critical RCE vulnerabilities, alongside additional cross-site scripting (XSS) fixes across the ecosystem.

Here is how the two critical RCE flaws break down:

• CVE-2026-108097 (SA-CORE-2026-014 — Drupal Core Field UI): This vulnerability resides in Drupal core’s field_ui module, the standard administrative interface used to attach and arrange fields on content types, user profiles, taxonomy terms, and other entities. On its own, Drupal core does not expose a direct path to trigger the flaw. However, contributed modules or custom application code can interact with field_ui in ways that open multiple exploitation paths—including at least one confirmed vector that requires zero authentication.
• CVE-2026-108099 (Entity List Contributed Module): The second critical RCE flaw impacts Entity List, a third-party contributed module designed to build entity listings without relying on Drupal's heavier Views module. Mirroring the core vulnerability, CVE-2026-108099 requires interaction with other contributed modules or custom code to become exploitable, and it likewise includes at least one known unauthenticated attack path.

From an architectural standpoint, this "latent core bug plus contributed trigger" pattern is a classic headache for enterprise IT and software developers. When security scanners look at a vanilla test instance, everything appears locked down. In production, however, almost nobody runs a naked Drupal core. With over one million websites relying on the open-source CMS—heavily concentrated across government agencies, higher education, and non-profit institutions—real-world deployments are virtually defined by their sprawling matrices of contributed modules and bespoke PHP glue code.

Affected Versions, Fixes, and End-of-Life Realities​

To close the vulnerabilities, administrators must apply updates across both the core framework (if running an affected branch) and the Entity List module (if installed). As The Drop Times noted in its coverage of the October security wave, updating Drupal core is only half the battle when contributed projects require separate remediation.

If your organization is still nursing along a Drupal 10 installation below the 10.6.x branch, or an early Drupal 11 release prior to 11.3.x, the Drupal project considers those branches end-of-life and unsupported. You cannot simply drop a minor point-release patch onto those servers; you will need to execute a branch upgrade or immediately apply compensating mitigations.

Why the Advance Warning Matters​

Earlier in the week, before the patches dropped on October 14, the Drupal Security Team issued an advance warning urging administrators to bring their sites up to the latest routine bugfix release beforehand so that dependency conflicts wouldn't stall the emergency security deployment.

Why sound the alarm before releasing the code? Seasoned sysadmins who lived through the infamous "Drupalgeddon" waves of the past decade know the drill. The moment an open-source project commits a security patch to a public repository, threat actors and automated diffing tools immediately reverse-engineer the code changes to spot the underlying flaw. Because at least one attack path for both CVE-2026-108097 and CVE-2026-108099 requires no authentication, the barrier to mass scanning and automated exploitation is remarkably low once an exploit chain is mapped out.

Actionable Remediation and Hardening Guide for IT Teams​

Whether you manage a fleet of Linux VMs, Windows Server hosts running IIS and PHP, or developer staging environments on Windows 11 workstations via WSL2 and Docker, here is the practical playbook to lock down your servers right now:

1. Audit Core and Contributed Dependencies Separately: Check your composer.json or Drupal status report across every environment. Upgrade Drupal core to 10.6.19, 11.3.19, or 11.4.10 immediately. Next, verify whether the entity_list module is present in your codebase; if it is, update it to 3.0.10.
2. Disable field_ui in Production (Immediate Mitigation & Best Practice): If change-freeze policies or complex dependency trees prevent you from upgrading Drupal core today, uninstall the core Field UI module (field_ui). The Drupal Security Team explicitly confirmed that uninstalling field_ui serves as an effective mitigation against CVE-2026-108097. In fact, based on general Drupal architecture best practices, field_ui only provides the graphical administrative interface for building fields; in mature CI/CD workflows where configuration changes are built locally and deployed via configuration management (drush config:import), leaving field_ui enabled on a live production server is unnecessary attack surface anyway.
3. Don't Rely Solely on WAFs or Drupal Steward: The advisory notes that while the Drupal Steward web application firewall service blocks some known attack vectors, it does not protect against every possible exploitation path. Treat perimeter filtering as temporary air cover, not a substitute for patching the PHP code.
4. Review Custom Modules: Because custom code can inadvertently expose the vulnerable functionality in both the core Field UI and Entity List modules, development teams should review any bespoke modules that programmatically invoke field configuration forms or entity listing routines.

Section Summary​

• The Threat: Two critical RCE flaws—CVE-2026-108097 in Drupal core's Field UI and CVE-2026-108099 in the contributed Entity List module—can allow unauthenticated remote code execution when combined with certain contributed modules or custom code.
• The Fixes: Update Drupal core to 10.6.19, 11.3.19, or 11.4.10, and update Entity List to 3.0.10.
• The Workaround: Uninstalling the field_ui module neutralizes the core vulnerability if you cannot patch immediately.

Are you still seeing field_ui left enabled on production web servers in your environment, or has your team locked down module states through automated deployment pipelines? Share how your SecOps team is handling this week's patch window in the WindowsForum.com cybersecurity and server administration discussions below.