Updated: Drupal fixes two critical RCE flaws, including Entity List module
Alongside CVE-2026-108097 in Field UI, Drupal fixed a separate critical RCE vulnerability, CVE-2026-108099, in the Entity List module. Affected websites should update the module to version 3.0.10.
Drupal Entity List RCE is a critical vulnerability, CVE-2026-108099, in the contributed Entity List module. On October 14, 2026, Drupal issued advisory SA-CONTRIB-2026-218 for it. A fix is available in Entity List version 3.0.10.
The new alert expands on the original security event, which concerned the critical CVE-2026-108097 flaw in Field UI. In the same release, Drupal therefore addressed two separate remote code execution vulnerabilities, or RCEs.
Drupal Entity List RCE: who is affected by the fix
Entity List module versions older than 3.0.10 are affected. Administrators of websites using this contributed module should deploy version 3.0.10 separately, alongside updating the Drupal core.
According to Drupal, the Entity List module alone is not sufficient for direct exploitation of the flaw. However, serious scenarios may arise when it is combined with other contributed modules or custom code. The advisory states that at least one known path does not require user authentication.
Drupal did not specify the modules or code modifications that create such combinations. Administrators therefore should not assume that installing Entity List alone, without further assessment, rules out the risk.
Field UI must also be addressed alongside Entity List
CVE-2026-108099 is separate from CVE-2026-108097 in Field UI. For the Field UI flaw, the Drupal core releases containing fixes are 10.6.19, 11.3.19, and 11.4.10, depending on the branch in use. As a temporary mitigation, Drupal lists uninstalling the field_ui module.
For CVE-2026-108099, a core update does not replace this measure: the affected Entity List module must be updated to version 3.0.10.
Active exploitation has not been confirmed
Available verified information does not confirm active exploitation of either CVE-2026-108097 or CVE-2026-108099 in real-world attacks. Before releasing the fixes, Drupal warned that exploits for the core flaw could emerge within hours or days after disclosure. However, this was a forecast, not confirmation that a public exploit existed.
Further information may come from any disclosure of specific modules or configurations that enable exploitation of Entity List, as well as notifications about publicly available exploits or active exploitation. The immediate step for administrators is to verify both the core version and the presence of the Entity List module, then deploy the available fixes.
Sources
- Drupal.org – SA-CONTRIB-2026-218 – Confirms CVE-2026-108099, the critical rating, affected Entity List versions before 3.0.10, the conditional unauthenticated path, and the fixed version 3.0.10.
- Drupal.org – SA-CORE-2026-014 – Confirms the separate critical CVE-2026-108097 flaw in Field UI, the fixed core versions, and the temporary mitigation of uninstalling field_ui.
- Drupal.org – PSA-2026-10-12 – Confirms that before the release, Drupal warned that exploits could emerge within hours or days after disclosure.
- BleepingComputer – Independently summarizes that the October 14 release included two critical RCE flaws, including Entity List.
Verified and updated: October 18, 2026 06:23
