Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw

Drupal has released security updates addressing five vulnerabilities, two of which are rated critical and could lead to remote code execution. CVE-2026-108099 affects the Entity List module and is not dangerous on its own, but combined with other contributed modules it can be triggered without authentication; fixing it requires upgrading to Entity List 3.0.10. CVE-2026-108097 affects the Field UI module in Drupal core and likewise becomes exploitable when paired with certain contributed modules, with uninstalling Field UI offered as a workaround; the official fix is to move to Drupal 11.4.10, 11.3.19, or 10.6.19, since older branches no longer get security support. The release also patches two cross-site scripting issues in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), plus an XSS bug in the Gin admin theme fixed in versions 5.0.16 and 4.1.4. While Drupal says none of these flaws have been exploited yet, it had already cautioned on October 12 that working exploits could appear within just hours or days, urging site owners to prioritize patching quickly.