DEV Community

Anoymask
Anoymask

Posted on

Drupal CVE-2026-108097 and CVE-2026-108099: Pre-Authentication RCE Vectors in Field UI and Entity List

#security #threatintel

1. Overview

The Drupal Security Team rated both issues as Critical (19/25) and confirmed known pre-authentication vectors. The core issue is not directly exploitable with Drupal core alone, and the Entity List issue is not directly exploitable with Entity List alone. The reviewed sources do not report exploitation in the wild or a successful public PoC.

2. Brief Summary

Remote code execution vulnerabilities exist in the Drupal core Field UI module and the Entity List contributed module. When combined with other modules or custom code, at least one pre-authentication vector exists. Exploitation in the wild has not been confirmed in the reviewed sources.

3. Attack Flow

The public advisory does not disclose specific module combinations or HTTP requests. The following outlines only the confirmed prerequisite conditions and does not speculate on undisclosed exploits.

Vulnerability ID Target Component and Scope Prerequisite Conditions for Exploitation Updates and Mitigations
CVE-2026-108097 Drupal core Field UI (>= 8.9.0 and < 10.6.19; >= 11.0.0 and < 11.3.19; >= 11.4.0 and < 11.4.10; or >= 12.0.0-alpha1 and < 12.0.0-beta2) Not directly exploitable in core alone. Requires a combination with a contributed module or custom code (at least one pre-authentication vector confirmed) Update to supported branches 10.6.19, 11.3.19, 11.4.10, or later (Drupal 12 development branch updates to 12.0.0-beta2 or later). As a temporary workaround, uninstalling Field UI is effective (Drupal Steward protects against only some known vectors)
CVE-2026-108099 Contributed module Entity List (prior to 3.0.10) Not directly exploitable on its own. Requires a combination with other contributed modules or custom code (at least one pre-authentication vector confirmed) Update to Entity List 3.0.10 or later. Uninstalling Field UI is a core-side workaround. Drupal Steward protection for this CVE has not been confirmed, and neither serves as a replacement for updating Entity List

Vector 1: RCE via Combination with Contributed Modules or Custom Code

  1. An attacker sends a crafted request to an input vector on a publicly accessible Drupal site.
  2. Vulnerable functionality in Field UI or Entity List becomes reachable through another contributed module or custom code.
  3. At least one known vector reaches the processing logic without authentication.
  4. When conditions are met, arbitrary code is executed on the Drupal site server.
  5. Specific module combinations and HTTP request formats are not disclosed in the public advisory.

4. Attacker Location and Execution Context

  • An external remote attacker who can reach the vulnerable functionality. At least one known vector does not require authentication.
  • Upon success, code may execute with the process privileges of the web server running Drupal.

5. Victim and Administrator Perspective

  • Victims and Users: Inference: Users may not notice any anomalies through requests that appear to be normal web browsing.
  • Administrators: Inference: Indicators may appear as anomalous requests in WAF or web access logs, shell or script execution originating from web processes, unexpected file creation, or unexpected outbound communication. These are not traces actually observed in this incident.

6. Success and Failure Conditions

Success Conditions

  • An affected version of Drupal core Field UI or Entity List is running.
  • Another contributed module or custom code makes the vulnerable functionality reachable from attacker input.
  • The path is not blocked by patches or mitigations. Uninstalling Field UI is a temporary mitigation for CVE-2026-108097. Protection via Drupal Steward is limited to specific known vectors for that CVE and does not guarantee protection for all vectors or the Entity List side.

Failure Conditions and Mitigations

  • Update Drupal core to patched versions 10.6.19, 11.3.19, 11.4.10, or later depending on the supported branch, and update Entity List to 3.0.10 or later. Because Drupal 8/9, 10.5.x and earlier, and 11.2.x and earlier are end-of-life, migrate to a supported branch. The affected range for the Drupal 12 development branch is >= 12.0.0-alpha1 and < 12.0.0-beta2.
  • If core cannot be updated immediately, uninstall the Field UI module.
  • Disable unnecessary contributed modules and verify that custom code does not expose Field UI or Entity List functionality to external input.

7. What Happens Upon Success

  • Arbitrary code executes on the server running Drupal.
  • Successful execution may lead to web shell deployment, configuration or content tampering, credential access, or execution of additional payloads. However, these follow-on activities have not been confirmed in the wild for these vulnerabilities.

8. Observable Logs

Specific exploit requests are not publicly available. Potential behaviors are evaluated by combining available indicators.

  • Email: There is no email vector specific to this issue.
  • Proxy / SWG / DNS: Inference: Review for unusual web requests to the public Drupal site, an increase in errors, and new outbound communication from the server. Specific request formats and module combinations have not been disclosed, so do not limit the investigation to POST or AJAX requests. The scope of visibility depends on log collection settings and retention.
  • Endpoint / EDR: Inference: Check for shells, script interpreters, or tools like curl or wget spawned by web server or PHP processes, along with the creation of unknown files in the web root or temporary directories.
  • Identity / IdP: Inference: Check for usage from unknown sources by Drupal administrators or service accounts, though IdP logs may not be generated for known pre-authentication vectors.
  • SaaS / Cloud: Inference: In managed Drupal or hosting environments, check deployment histories, module versions, WAF configurations, file integrity monitoring (FIM), and container recreation histories.
  • Network: Inference: Check for unusual outbound connections from the web server, internal reconnaissance, and communication to administrative ports.

9. Determining Attack Success

Public Information Review Scope

Reviewed advisories indicate prerequisite conditions but do not report active exploitation attempts or successful compromises in the wild.

Internal Evaluation Criteria

  • Attack Attempt Observed (Success Unconfirmed): Criteria applied when requests are confirmed to target vulnerable functionality. This does not mean such requests have been observed in public information. Do not judge code execution as successful based solely on suspicious web requests; correlate them with web process execution records, unknown files, and outbound communication. Scope: Criteria for internal organization investigations. This does not represent public observation records.

Distinguish between RCE preconditions described in research and advisories and actual attack success in real environments.

10. Investigation Playbook

  • Investigation Starting Point: Start from the use of affected versions of Field UI / Entity List, unapplied updates, anomalous requests to public Drupal instances, and suspicious web process execution.
  • Initial Verification: Check versions and enablement states of Drupal core, Entity List, and all contributed modules, alongside custom code, external exposure scope, and update timestamps.
  • Endpoint and Server Investigation: Preserve changes to the web root, temporary directories, settings.php, module directories, process trees, cron jobs, services, and container images.
  • Authentication and Cloud Investigation: Review usage history for Drupal administrators, databases, hosting, and cloud credentials to distinguish intrusion via pre-authentication vectors from administrator credential abuse.
  • Subsequent Activity: Check for web shells, additional users, configuration tampering, database access, internal reconnaissance, and external transmission. These are not confirmed subsequent activities from this incident.
  • Containment: Inference: Restrict or isolate external access to the target site at the network layer before applying updates. Do not assume that switching to maintenance mode blocks all exploitation vectors. If signs of compromise are present, rebuild from a known good image and rotate related credentials.
  • Judgment Categories: Evaluate vulnerable configuration presence, attack requests, code execution, persistence, information access, and external transmission separately.

11. Defense and Detection Ideas

  • Single Event: Treat the spawning of a shell or script interpreter from a Drupal web process as a high-priority alert.
  • Temporal Correlation: Correlate anomalous web requests, child process spawning by PHP/web processes, file creation, and outbound communication within a short time window.
  • Threat Hunting: Cross-check the presence of affected core versions, Entity List prior to 3.0.10, enabled Field UI states, related custom code, and new PHP or script files in the web root.
  • Log Limitations: Because specific exploit requests and module combinations are private, detection cannot rely solely on IOC matching. Combine process, file, and network telemetry.
  • Priority Mitigations: Prioritize emergency updates, removal of unnecessary modules, web process execution control, file integrity monitoring, and WAF and outbound traffic control.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-108097 is an RCE vulnerability in the Drupal core Field UI module, which cannot be exploited directly via Drupal core alone.
  • CVE-2026-108097 has multiple severe exploitation vectors involving combinations with contributed modules, and at least one does not require authentication. Custom code may also expose the vulnerable functionality.
  • The affected Drupal ranges are >= 8.9.0 and < 10.6.19; >= 11.0.0 and < 11.3.19; >= 11.4.0 and < 11.4.10; or >= 12.0.0-alpha1 and < 12.0.0-beta2.
  • CVE-2026-108099 is an RCE vulnerability in Entity List prior to 3.0.10, which is not directly exploitable on its own but has at least one pre-authentication vector when combined with other contributed modules or custom code.
  • Patched versions for supported Drupal core branches are 10.6.19, 11.3.19, 11.4.10, and for Entity List, version 3.0.10. Uninstalling Field UI is a temporary mitigation for CVE-2026-108097 and does not replace fixes on the Entity List side. End-of-life branches require migration to supported branches.
  • The Drupal Security Team rated both issues as Critical (19/25) with theoretical exploitation, and the reviewed public advisories do not report confirmed exploitation in the wild.

Inference

  • Whether individual Drupal sites are exploitable depends on whether installed contributed modules and custom code connect the vulnerable functionality to external input.
  • While attack details remain limited, organizations must audit not only updates but also the enablement status of Field UI / Entity List and input paths in surrounding modules on a component basis.

Hypothesis

No additional hypotheses. Unverified items are listed under "Unresolved Items and Further Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application medium Known vectors, including unauthenticated ones, can lead to RCE via module combinations on publicly accessible Drupal sites. Active exploitation is unconfirmed. Source

14. Unresolved Items and Further Investigation

  • Specific contributed module combinations, HTTP requests, internal functions, and public PoCs that establish pre-authentication vectors are not disclosed in the advisory.
  • Scans, attack attempts, and successful compromises in the wild have not been confirmed in public information.
  • The breakdown of known vectors protected by Drupal Steward and all unprotected vectors has not been published.

15. Impact on SOCs and Organizations

Drupal is used in public-facing websites, including government agencies, universities, and non-profit organizations. Organizations should inventory core versions alongside Field UI, Entity List, related contributed modules, and custom code simultaneously. Even after updating, look for suspicious child processes or unexpected file creation by web processes.

16. Summary by Role

  • For SOCs: Correlate anomalous requests to public Drupal instances with shell or script execution, unknown file creation, and outbound communication originating from web processes.
  • For Administrators: Update Drupal core to a patched release for the branch you run, and update Entity List to 3.0.10 or later. If core cannot be updated immediately, uninstall Field UI. Do not confuse this temporary mitigation with fixes on the Entity List side.
  • For Users: This is a server-side vulnerability that does not require user interaction. No special action is required by general users.

Top comments (0)