Security1 hOctober 17, 2026, 21:32

Drupal patches two critical RCE vulnerabilities

Drupal has patched two critical remote code execution flaws in the core Field UI module and the contributed Entity List module, affecting all supported versions of the CMS. Fixes ship in 10.6.19, 11.3.19 and 11.4.10, with Entity List updated to 3.0.10. The security team warns exploits could emerge within hours or days.

BleepingComputer

Open source

CVE-2026-108097 is an RCE in Drupal core's Field UI module
CVE-2026-108099 is an RCE in the contributed Entity List module
Fixes: Drupal 10.6.19, 11.3.19, 11.4.10 and Entity List 3.0.10
Over one million websites run on Drupal

#Drupal

CERT/CC discloses critical RCE vulnerabilities in Thelia 2.6.0 and 2.6.1

Security

SAP Patches Four Critical NetWeaver and S/4HANA Vulnerabilities

Security

Cisco patches 35 vulnerabilities, over a dozen rated critical

Security

Drupal patches two critical RCE vulnerabilities

CERT/CC discloses critical RCE vulnerabilities in Thelia 2.6.0 and 2.6.1

SAP Patches Four Critical NetWeaver and S/4HANA Vulnerabilities

Cisco patches 35 vulnerabilities, over a dozen rated critical

Adobe Patches 36 Vulnerabilities, Including Critical Flaws in Connect and AEM Forms