| Severity | CRITICAL |
| Threat Category | Vulnerability – Remote Code Execution |
| Affected Platforms | Drupal core Field UI module: 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, 11.4.0 to before 11.4.10, and 12.0.0-alpha1 to before 12.0.0-beta2. Entity List contributed module: all versions before 3.0.10. |
| CVE | CVE-2026-108097 (Drupal core) and CVE-2026-108099 (Entity List module) |
| CVSS | Critical – 19/25 on the Drupal Security Team scale (each CVE); no NVD CVSS assigned as of 20 October 2026 |
1. Overview
Drupal has released fixes for two critical remote code execution (RCE) vulnerabilities in its content management software. CVE-2026-108097 affects the Field UI module in Drupal core, and CVE-2026-108099 affects the contributed Entity List module. Both were disclosed on 14 October 2026 in advisories SA-CORE-2026-014 and SA-CONTRIB-2026-218, carry an identical Drupal risk score of 19 out of 25 (Critical), share the same attack characteristics, and were reported by overlapping members of the Drupal Security Team and the same external researcher. They are treated together in this advisory because they are a single coordinated disclosure describing the same class of flaw across core and a contributed module.
Neither flaw is directly exploitable on its own. In each case the vulnerable component exposes functionality that becomes dangerous when combined with certain contributed modules or custom code, and at least one known exploitation path requires no authentication. Successful exploitation allows an attacker to execute arbitrary code on the web server, which means full compromise of the website and potentially the underlying host.
No NVD CVSS score had been assigned at the time of writing; Drupal uses its own 25-point security risk scale, on which both issues are rated Critical. The Drupal Security Team has publicly warned that working exploits could be developed within hours or days of the patches, so administrators should treat updating as urgent.
2. Who is Affected
Any organisation running a Drupal website is potentially affected. Drupal is widely used across government offices, ministries, agencies, universities and private organisations in Bhutan to run public-facing websites and internal portals. Sites running an affected version of Drupal core are exposed through CVE-2026-108097. Sites that additionally use the Entity List contributed module are exposed through CVE-2026-108099 as well.
BtCIRT has not received any reports of confirmed exploitation within Bhutan at the time of publication, and no public proof-of-concept or in-the-wild exploitation had been reported by the cited sources. The severity is nonetheless assessed as CRITICAL for the following reasons:
- Successful exploitation yields remote code execution, the most severe outcome for a web application, giving an attacker full control of the site and its data.
- At least one known exploitation path requires no authentication, so an external attacker needs no account on the target site.
- The Drupal Security Team has explicitly warned that exploits could be developed within hours or days, and public technical interest in Drupal RCE flaws is historically high.
- Both issues are rated 19 out of 25 (Critical) on Drupal’s own scale. No NVD CVSS score is available yet, so the absence of a CVSS number should not be read as lower risk.
- Websites are typically Internet-facing by design, so vulnerable Drupal sites are directly reachable by opportunistic scanning once an exploit circulates.
3. How the [Threat/Vulnerability/Attack] Works
- Stage 1 – Root Cause
In both CVE-2026-108097 (the Field UI module in core) and CVE-2026-108099 (the Entity List module), the affected component exposes internal functionality that is not reachable in a dangerous way using that component alone. The condition only becomes exploitable when a contributed module or custom code supplies the path that reaches the vulnerable functionality. Drupal has deliberately withheld the technical specifics, including the names of the triggering modules and the exact request format, to slow the development of exploits. No further mechanism detail is available from the vendor advisories.
- Stage 2 – Exploitation
Where a vulnerable path is present, an attacker sends a crafted request to the site. At least one known path requires no authentication, meaning the attacker does not need to log in or hold any account. The request causes arbitrary code to run within the context of the web application.
- Stage 3 – Impact
With code execution on the web server, an attacker can read and modify the site’s database and files, steal credentials and personal data, deface or take the site offline, plant web shells and backdoors for persistent access, and attempt to move laterally to other systems on the same network or hosting environment. For a government or public-sector site, this also carries a risk of misinformation and loss of public trust.
- Stage 4 – Fix and Disclosure
Drupal published advisories SA-CORE-2026-014 and SA-CONTRIB-2026-218 on 14 October 2026, with fixed releases of Drupal core 10.6.19, 11.3.19 and 11.4.10, and Entity List 3.0.10. The issues were reported by members of the Drupal Security Team together with an external researcher. The Drupal Security Team paired the releases with a public warning that exploits could appear quickly.
4. Indicators to Watch For
- The site runs an affected Drupal core version below 10.6.19, 11.3.19, and 11.4.10. (Versions prior to 10.6.x and 11.3.x are end-of-life and unpatched). Check with: drush core:status or composer show drupal/core.
- The Field UI module is enabled, or the Entity List module is installed below 3.0.10. Check with: drush pm:list | grep -E “field_ui|entity_list”.
- Unexpected PHP files or scripts appearing under the public files directory (for example sites/default/files) or elsewhere in the web root, which may indicate a planted web shell.
- New administrator accounts, new user roles, or changes to permissions that your team did not make.
- Unusual POST requests to administrative or module routes in the web server access logs, especially from unfamiliar IP addresses, and unexpected outbound connections from the web server.
- Unexplained modifications to site content, configuration, or theme and module files.
5. Recommendations
5.1. For organizations and government offices:
- Update Drupal core immediately to 11.4.10, 11.3.19 or 10.6.19 as it matches your branch. This single update addresses CVE-2026-108097.
- If your site uses the Entity List contributed module, update it to version 3.0.10 to address CVE-2026-108099.
- If you cannot update core immediately, apply the vendor’s interim mitigation and uninstall the core Field UI module (field_ui). It is an administrative configuration tool and can be safely removed from a production site until the update is applied.
- Inventory your contributed and custom modules. Because contributed modules and custom code provide the exploitation path, reducing unnecessary modules lowers your exposure.
- If your site runs an end-of-life Drupal version (10.5.x or earlier, 11.2.x or earlier, or Drupal 8 or 9), note that no fix is available for your branch. Plan an upgrade to a supported major version as a priority, and apply compensating controls such as a web application firewall in the meantime.
- Treat Drupal Steward or any web application firewall as partial protection only. The vendor states Steward covers some but not all known attack paths, so updating remains necessary.
- After updating, review logs and the indicators in Section 4 for signs of prior compromise. If evidence is found, treat the server as compromised: isolate it, rotate all credentials and API keys, remove any web shells, and restore from a known-good backup.
- Ensure backups are current and stored separately from the web server so they cannot be altered from a compromised site.
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt.
7. Sources and References
- Drupal core – Critical – Remote code execution – SA-CORE-2026-014 (14 October 2026). https://www.drupal.org/sa-core-2026-014
- Entity List – Critical – Remote code execution – SA-CONTRIB-2026-218 (14 October 2026). https://www.drupal.org/sa-contrib-2026-218
- CVE-2026-108097 – CVE Record (14 October 2026).
https://www.cve.org/CVERecord?id=CVE-2026-108097 - CVE-2026-108099 – CVE Record (14 October 2026).
https://www.cve.org/CVERecord?id=CVE-2026-108099 - Drupal patches critical RCE flaws, warns exploits may emerge soon (Bill Toulas, BleepingComputer) (17 October 2026). https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/