CVE-2026-108099 — Your Drupal site could be hacked without a password: two critical flaws to patch fast

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

Your Drupal site could be hacked without a password: two critical flaws to patch fast

Drupal patched two remote code execution vulnerabilities on October 14, one in core and one in the Entity List module. Its experts expect an exploit within days: versions to install and a workaround.

Oct 18, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)