Drupal patches two critical RCE flaws, warns exploits may follow fast
The project fixed bugs in core's Field UI module and the contributed Entity List module, and told admins to update before the disclosure window closed.
Drupal has patched two critical vulnerabilities that could let attackers run code remotely on sites running any supported version of the content management system, BleepingComputer reported on October 17, 2026.
The flaws sit in the core Field UI module and in Entity List, a contributed module for building entity lists without Views. The project gave an advance warning earlier in the week, telling administrators to reserve time for updates because "exploits might be developed within hours or days."
What the advisories say
The Field UI advisory says the flaw can't be exploited with Drupal core alone, but contributed modules can open several exploitation paths, including at least one that needs no authentication. Custom code may also expose the vulnerable functionality. The Entity List flaw works in a similar way, requiring interaction with contributed modules or custom code, and also has at least one known path that doesn't require authentication.
Who's affected
Drupal said all currently supported versions of core are affected. Versions before 10.6.x and Drupal 11 releases before 11.3.x are end-of-life and unsupported. Drupal 12 pre-releases before beta2 are also affected, though those aren't meant for production.
What to do
Administrators were told to update core to 10.6.19, 11.3.19 or 11.4.10 depending on their branch, and Entity List to 3.0.10. Those who can't upgrade were advised to uninstall the core Field UI module (field_ui) as an effective mitigation. Drupal Steward, the project's protection service, covers some known attack vectors but not every possible exploit.
The project's own warning is the useful signal here: patch windows for widely deployed open-source CMS software tend to be short once details are public.
CVE references
Sources
- Drupal patches critical RCE flaws, warns exploits may emerge soonPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning