DEV Community

kozhevniko
kozhevniko

Posted on

Drupal's October 2026 Criticals and the Limits of "Just Update"

#drupal #remotecodeexecution #securityadvisory #vulnerability

Drupal's October 2026 Criticals and the Limits of "Just Update"

"Just update" is the correct first instruction for CVE-2026-108097 and CVE-2026-108099, and it is also incomplete advice. The two advisories published on 14 October 2026 describe what to upgrade and, in the same text, describe why the upgrade alone may not eliminate the reachable path on a given site.

The two facts that complicate the instruction

The Field UI advisory states that the vulnerability is not directly exploitable with core alone and that contributed modules and custom code provide multiple serious exploit paths, at least one of which requires no authentication. The Entity List advisory repeats the structure for the contributed module.
The second complication is version support. The fixed releases are 10.6.19, 11.3.19 and 11.4.10, plus 12.0.0-beta2 for the pre-release line. Drupal 8 and 9 are end of life, Drupal 10.5.x and earlier and Drupal 11.2.x and earlier receive no security coverage. For those branches, "just update" means a migration, and the vulnerability stays open for as long as the migration takes.

Reading the risk score correctly

Both advisories carry a 19/25 score with attack complexity Basic, confidentiality and integrity impact All, and exploitation Theoretical. The Theoretical rating describes exploit availability at the time of publication. It does not mean exploitation is impractical. BleepingComputer reported that Drupal issued an advance warning asking administrators to reserve time for core updates because exploits might be developed within hours or days, and that more than one million websites run Drupal, with heavy use among government, universities and non-profits.
A high-impact vulnerability in a widely deployed platform with a short predicted exploitation window is the profile that justifies an emergency change, even when the score's exploitation field says Theoretical.

What the vendor added beyond the patch

Two mitigations appear in the advisories, and both are worth understanding as expressions of residual risk.

  • Uninstall the core Field UI module (field_ui) while updating. This removes the affected core component from the reachable surface. It does not address Entity List and does not protect custom code calling the same functionality.
  • Drupal Steward protection, documented as covering some known attack vectors for CVE-2026-108097, with the explicit caveat that it will not cover all possible exploits and that sites should upgrade in case additional vectors are discovered. The presence of both a component-removal recommendation and a WAF-style service with a stated coverage ceiling is the vendor telling you the patch is necessary and the surrounding reachability is site-specific.

A short honest checklist

  1. Find every Drupal site you operate, including contractor-hosted and marketing properties.
  2. Record the core branch and the Entity List version for each.
  3. Upgrade core and Entity List in the same window where possible.
  4. For sites where the core update slips, uninstall field_ui and document the effect on content administration.
  5. For end-of-life branches, start the migration and treat the site as exposed until it completes.
  6. After the window, verify the running version from the application rather than a repository tag.

References

Top comments (0)