Drupal has released security updates, including fixes for two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 and CVE-2026-108099. These flaws could allow remote attackers to execute malicious code on affected web servers.

Affected Systems

The following system versions are affected but not limited to:

• Drupal Core (Field UI module): versions prior to 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2

• Drupal Contributed Module (Entity List): Versions prior to 3.0.10.

Security Risks

Successful exploitation could allow attackers to execute arbitrary code on affected servers, potentially resulting in unauthorized access, website compromise, or service disruption.

For complete details on all advisories published by Drupal, refer to the Drupal Security Advisories.

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:
 

1. Upgrade to the latest supported version of the installed software as soon as possible to ensure continued access to technical support and security patches.
   
   The recommended software versions to upgrade to are as follows,but not limited to:

• Drupal Core (Field UI module): Upgrade to version 10.6.19 or above, 11.3.19 or above, 11.4.10 or above, and 12.0.0‑beta2 or above.

• Drupal Contributed Module (Entity List): Upgrade to version 3.0.10 or above.

2. Before performing any update tasks, ensure that you have a backup of your data.

For further information and support, please contact the National Cyber Security Authority (NCSA) by emailto rwcsirt@ncsa.gov.rw or call us on 9009.

References

• Drupal Core Releases

• Entity List Module Releases

• Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw

• Drupal patches critical RCE flaws, warns exploits may emerge soon