Drupal Core RCE Flaws: Patch Now, Exploits Coming
Drupal patches two critical RCEs in Field UI and Entity List. No exploitation confirmed yet, but exploits expected within hours of disclosure. Patch core to 11.4.10 or later.
Marisol "Fuse" DelgadoDrupal is pushing urgent patches for two critical remote code execution vulnerabilities. The Drupal security team warned in its October 12 advisory that exploits could emerge “within hours or days.” If you run Drupal, this is a patch-now situation.
What’s vulnerable
The Field UI module ships with Drupal core and manages field configuration on content types. SA-CORE-2026-014 describes a critical RCE flaw in it. The vulnerability is not directly exploitable through core alone, but multiple exploit paths exist when contributed modules are present, including at least one unauthenticated path. Drupal rates it 19 out of 25 on its internal risk scale.
The second flaw is in the Entity List contributed module (SA-CONTRIB-2026-218), which provides admin-facing views of content entities. Same vulnerability class, same risk rating: Critical, 19/25. Unauthenticated exploit paths exist in common contributed-module configurations.
Two cross-site scripting bugs in the Link and Navigation modules were also patched in the same release.
What to do
Core Field UI flaw (SA-CORE-2026-014):
Update Drupal core to 11.4.10, 11.3.19, or 10.6.19 (or a later release in your branch). If you cannot patch today, disabling the field_ui module removes the attack surface immediately. That disables the admin UI for managing content-type fields, so it is a temporary step, not a permanent fix.
Entity List module (SA-CONTRIB-2026-218):
Update Entity List to version 3.0.10 or later.
Priority call
Patch the core Field UI flaw first. Drupal core runs on every Drupal installation; Entity List is only present if someone explicitly installed it.
If you are on managed hosting and cannot push a core update today, disable field_ui in the module admin and schedule the full core update for tonight. For self-managed sites, run composer update drupal/core-recommended in staging, verify no deprecation errors, then deploy.
Drupal’s advisory noted that exploits could surface within hours, not days. That window has passed. Sites that have not yet patched are running exposure now.
For full patch details and a complete module list, see the official security advisories at drupal.org/security. SecurityWeek has additional reporting on the exploitation risk context.
Related coverage: Next.js Out-of-Band Update Fixes Two Critical RCEs and Bricksforge Plugin Flaw Gets Exploited Days After Patch.
Found this useful? Share it.