1. Executive summary
Drupal has released fixes for five vulnerabilities, two of them critical remote code execution flaws: CVE-2026-108099 in the contributed Entity List module and CVE-2026-108097 in the core Field UI module. Neither is reachable through its own component alone, but Drupal states that contributed modules provide exploit paths, and at least one known path for each requires no authentication. Drupal has not reported exploitation in the wild, but on October 12 it warned that exploits might be developed within hours or days of disclosure. No CVSS score, severity rating beyond Drupal's own critical label, CISA KEV status or EPSS score has been resolved for either CVE, so this advisory does not assign one; the exposure for EMEA financial services clients is any internet-facing Drupal site running Field UI or Entity List alongside contributed modules that reach the vulnerable code. The XSS flaws in the same release (CVE-2026-108515, CVE-2026-108514, and the Gin theme defect) are lower priority but ship in the same update.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The two critical flaws are reachable only through combinations of components, which is why Drupal's own advisory stops short of calling either exploitable on a default install. The risk sits in the contributed-module layer that most production Drupal sites carry.
Confirmed steps, as stated by Drupal:
- An attacker identifies a Drupal site running the core Field UI module (CVE-2026-108097) or the Entity List module (CVE-2026-108099) together with a contributed module that exposes the vulnerable functionality.
- For CVE-2026-108097, a contributed module provides an exploit path to the Field UI flaw; at least one such path requires no authentication.
- For CVE-2026-108099, a contributed module provides an exploit path to the Entity List flaw; at least one such path requires no authentication. Drupal also notes that custom code may expose the vulnerable functionality.
- Successful exploitation leads to remote code execution on the site's server.
The source does not describe the underlying vulnerability mechanism (the specific input handling or code path that yields RCE), the payload an attacker would deliver, any post-exploitation behaviour, persistence, privilege escalation, command-and-control, lateral movement or data access. Those specifics are absent from the Drupal advisory as reported and are not inferred here.
The remaining three fixes in the same release are cross-site scripting issues: CVE-2026-108515 covers XSS holes in the core Link module, CVE-2026-108514 is an XSS flaw in the Navigation module, and a separate defect in the Gin administration theme could lead to XSS, fixed in Gin 5.0.16 and 4.1.4. XSS does not give code execution on the server, but on an administrative theme it can be used to act with an administrator's session.
Drupal has made no statement that any of these vulnerabilities has been exploited in the wild. The "hours or days" warning of October 12 was a general call to reserve time for core updates, not a report of observed exploitation. Treat the exploitation status as unknown rather than confirmed either way.
The Field UI flaw was fixed on October 14 according to The Hacker News; SecurityWeek's October 19 piece reports the same version numbers. The two accounts agree on the fixed versions and on the no-login exploit path, so those facts are corroborated across both. The claim that at least one unauthenticated exploit path exists rests on Drupal's own advisory as quoted by both outlets; no public exploit code is referenced in either source.
4. Mitigation & containment
P1 within 24h
- Inventory every Drupal instance and record its core version and contributed-module list. Any site on 11.4.x below 11.4.10, 11.3.x below 11.3.19, or 10.6.x below 10.6.19 is in scope for CVE-2026-108097.
- Update Drupal core to 11.4.10, 11.3.19 or 10.6.19. Sites on end-of-life releases receive no security updates and must be migrated to a supported branch; there is no patch for them.
- Where core cannot be updated immediately, uninstall the core Field UI module as Drupal's stated mitigation for CVE-2026-108097. Confirm no contributed module depends on it before removal.
- Update the Entity List module to 3.0.10 for CVE-2026-108099.
- Identify which contributed modules on each site reach the Field UI or Entity List vulnerable functionality, and treat any site carrying an unauthenticated path as internet-exposed until patched.
P2 within 72h
- Update the Gin administration theme to 5.0.16 (5.x branch) or 4.1.4 (4.x branch) to close the XSS defect.
- Apply the core update that carries the Link module (CVE-2026-108515) and Navigation module (CVE-2026-108514) XSS fixes; these ship in the same core releases as the RCE fix.
- Review custom code on each site for functionality that duplicates or exposes the Entity List or Field UI vulnerable paths, since Drupal states custom code may expose the vulnerable functionality.
- Restrict access to administrative paths and the Field UI at the reverse proxy or WAF for any site that cannot be patched inside 24h, and require authentication at the edge for those paths.
P3 within 7 days
- Add the fixed version numbers to configuration baselines and CI checks so new builds cannot ship a vulnerable core or Entity List version.
- Review web server and Drupal logs for POST requests to Field UI and Entity List endpoints from unauthenticated clients, and for unexpected PHP process activity, as a retrospective check for exploitation before patching.
5. Indicators of compromise
No indicators of compromise available in the source material. The sources give fixed version numbers and CVE identifiers but no hashes, network indicators, file paths or behavioural artefacts attributable to an exploit.
6. Detection
Insufficient indicators to author detection rules. The sources describe no exploit strings, payload filenames, command lines, registry keys or network artefacts, and a rule built on CVE identifiers or product names would detect reporting about the flaw rather than the flaw itself.
7. Sources
- SecurityWeek, "Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw", https://www.securityweek.com/drupal-warns-of-fast-exploitation-risk-for-critical-core-rce-flaw/, 2026-10-19.
- The Hacker News, "Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules", https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html, October 2026.
- Drupal security advisories page, referenced by both outlets; the specific advisory URLs are not given in the source material.
8. Adverse Trace position
No CVSS score, CISA KEV status or EPSS score has been resolved for CVE-2026-108097 or CVE-2026-108099, so Adverse Trace does not assign a severity rating here and does not treat either as confirmed exploited. The exposure is real for any client running internet-facing Drupal with Field UI or Entity List and contributed modules that reach the vulnerable code, because Drupal states at least one unauthenticated path exists for each; the fixed versions are 11.4.10, 11.3.19, 10.6.19 and Entity List 3.0.10, and the Field UI module can be uninstalled as an interim measure. The exploitation-path detail is single-sourced to Drupal's advisory as quoted by SecurityWeek and The Hacker News; verify module dependencies before uninstalling Field UI. Adverse Trace will monitor for public exploit code and for any CISA KEV addition against these CVEs, and will reissue this advisory if either appears. Clients should confirm their Drupal core and Entity List versions against the fixed releases and report any unpatched internet-facing instance to their account team.
Published via PulseTrace — Adverse Trace threat intelligence.