CVE-2026-108099Vulnerability
Reported by 3 independent sources · first reported by The Hacker News · last reported
Last reported 5 days ago
What the reports say
4 reports, newest first · the exact sentence from each-
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw“The first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099.”
-
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099“The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List.”
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“…540, CVE-2026-84897, CVE-2026-83540 (WolfSSH), GHSA-673q-mjm6-r5xr, CVE-2026-96889, GHSA-p3m5-59mp-jv5r (Next.js), CVE-2026-108097, CVE-2026-108099 (Drupal), CVE-2026-15911 (confluent-kafka), CVE-2026-102764 (BeyondTrust Remote Support), CVE-2025-61624 (Fortinet FortiOS, FortiPAM…”
-
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules“Separately, the Entity List module received its own critical remote code execution advisory, CVE-2026-108099, with the same conditions, including a known path that needs no login.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-108097, CVE-2026-108515, CVE-2026-108514, CVE-2026-34073, CVE-2021-36260, CVE-2026-83498, CVE-2026-74580, CVE-2026-79724, CVE-2026-85025, CVE-2026-81204, CVE-2026-103947, CVE-2026-103946, CVE-2026-106126, CVE-2026-14814, CVE-2026-16301, CVE-2026-92883, CVE-2026-97229, CVE-2026-85947, CVE-2026-85948, CVE-2026-85955
Thanks — we review every report.