Your Drupal site could be hacked without a password: two critical flaws to patch fast

“Exploits could be developed within hours or days.” The warning comes from Drupal's security team, according to BleepingComputer. It was published on October 12, ahead of two advisories released on October 14, both rated critical. They fix vulnerabilities that could allow remote code execution on a Drupal site. This content management system powers more than one million sites, according to BleepingComputer.

No attacks have been reported so far. The advisories rate exploit maturity as “theoretical”: there is no public code or documentation. But releasing a patch gives attackers a map of what has changed. As early as October 12, Drupal had asked administrators to set aside time for the update on release day.

A core flaw made reachable by modules

The first flaw, CVE-2026-108097 (advisory SA-CORE-2026-014), is in Field UI, the core module used to manage content fields. It has a peculiarity: core alone cannot be exploited. It is the add-on modules, built by the community, that open “several serious exploitation paths,” according to the advisory. At least one of these paths requires no authentication. Custom-built code can also expose the vulnerable function.

The second, CVE-2026-108099 (advisory SA-CONTRIB-2026-218), affects Entity List, an add-on module that creates lists of entities without using Views. The pattern is the same: the flaw cannot be exploited with this module alone, but it can be in combination with other modules, again without authentication for at least one known path.

Both flaws score 19 out of 25 on Drupal's risk scale. The core flaw was reported by Drew Webber of the Drupal security team and by Octavio Galland.

Versions to install

• Drupal 11.4: upgrade to 11.4.10;
• Drupal 11.3: upgrade to 11.3.19;
• Drupal 10.6: upgrade to 10.6.19;
• Entity List: upgrade to 3.0.10;
• Drupal 12 pre-releases older than 12.0.0-beta2 are also affected.

Affected versions go back as far as Drupal 8.9.0. Branches 11.2 and earlier, as well as 10.5 and earlier, no longer receive security patches. If your site runs on one of them, you must first migrate to a supported branch.

What if the update can't wait?

Drupal offers a workaround: uninstall the Field UI module (field_ui) while you update the site. This module handles structure settings in the administration interface. Sites subscribed to the Drupal Steward protection service are partially covered: the service blocks some known attack vectors, but not all, the advisory states.

As with the critical Magento flaw this week, the longest part is often not the update itself but the inventory: knowing which sites, at which provider, still run on a forgotten branch. The next thing to watch for is the appearance of the first public exploit code.