Drupal says core alone does not provide a direct exploitation path. However, combinations with contributed modules can expose serious attack paths, including at least one that requires no login. Custom code can also expose the vulnerable functionality. Read SA-CORE-2026-014.Entity List: SA-CONTRIB-2026-218 addresses a critical remote code execution vulnerability in versions earlier than 3.0.10. Drupal recommends updating to Entity List 3.0.10. The advisory describes exploitation paths involving other contributed modules or custom code, including a path that does not require authentication. Read the Entity List security advisory.These are separate projects with separate fixes. Confirm their installed versions rather than assuming a core update has handled them.
What does Drupal 11.4.10 fix?
The Navigation issue, CVE-2026-108514, involves attributes that are not sufficiently sanitized. The advisory says exploitation requires an attacker with permission to enter HTML containing particular data attributes, or with the administer menu permission. Read SA-CORE-2026-016.
| Advisory | Component | Vulnerability | Drupal severity |
|---|---|---|---|
| SA-CORE-2026-014 | Field UI | Remote code execution | Critical, 19/25 |
| SA-CORE-2026-015 | Link | Cross-site scripting | Moderately critical, 13/25 |
| SA-CORE-2026-016 | Navigation | Cross-site scripting | Moderately critical, 12/25 |
For the Field UI vulnerability, Drupal identifies uninstalling the core Field UI module, field_ui, as a mitigation while updating. Have the site maintainer review dependencies and configuration consequences before doing so. This addresses that vulnerability, not the two XSS issues or separate contributed-project advisories. Read the Field UI mitigation.
Why the Field UI vulnerability needs urgent attention
The Link module issue, CVE-2026-108515, involves insufficient sanitization of certain markup under some circumstances. Drupal rates it moderately critical. Read SA-CORE-2026-015.For site owners, the immediate task is to identify the installed version, assign responsibility for the update, and get the appropriate patched release deployed.Gin Admin Theme: SA-CONTRIB-2026-219 addresses an XSS vulnerability. The published fixes are Gin 4.1.4 for version 4 users and Gin 5.0.16 for version 5 users. The advisory describes permission-related conditions involving certain HTML attributes or menu administration. Read the Gin security advisory.For organizations managing several websites, track each deployment separately. A successful update on one site does not establish the status of another.
What the Link and Navigation fixes address
composer update "drupal/core-*" --with-all-dependencies
Assign an owner and confirm when the appropriate patched version will reach production. Include any applicable contributed-project fixes in that conversation.With project-local Drush, the usual database-update and cache-rebuild commands are:The advisory identifies exploit paths; it does not report confirmed exploitation in the wild. That distinction prevents unnecessary speculation, but it is not a reason to postpone patching.
Which Drupal version should you install?
The most serious issue, CVE-2026-108097, concerns the Field UI module.
| Current supported branch | Security release |
|---|---|
| Drupal 11.4.x | 11.4.10 |
| Drupal 11.3.x | 11.3.19 |
| Drupal 10.6.x | 10.6.19 |
Drupal 11.4.9 addressed navigation layout behavior, editor maintenance, and recipe configuration. It does not contain these newly released security fixes.Two contributed-project advisories published on the same day deserve attention where those projects are installed.
Already updated to Drupal 11.4.9? This update still matters
A maintenance update completed a few days ago is useful preparation. It does not eliminate the need to respond to a later security advisory.The October 14 announcements cover three Drupal core issues:Drupal released version 11.4.10 on October 14, 2026, addressing three core security vulnerabilities. The release includes a critical remote code execution fix and two cross-site scripting fixes. Drupal urges affected sites to update immediately after reviewing the advisories. Read the official release notes.
Check Gin and Entity List separately
Version 11.4.10 is a security release, and its release notes state that no other fixes are included. Sites on 11.4.9 should therefore include this new update in their immediate response. Read the Drupal 11.4.10 release notes.The published update targets are:Drupal also says its Steward service protects against some known attack paths, but not every possible exploit. Protected sites still need to update. Read Drupal’s security notice.These scores use Drupal’s security risk scale, not the ten-point CVSS scale. The advisories describe different conditions for exploitation, so the vulnerabilities should not be treated as interchangeable. See Drupal’s security announcements.
Is there a temporary mitigation?
If there are signs of unauthorized activity, handle that as an incident alongside patching. An update closes the addressed vulnerability; it does not establish that earlier malicious changes have been removed.Cross-site scripting, commonly shortened to XSS, can cause malicious script to execute in another person’s browser in the context of the affected website.What most often slows your team’s response to a security release: dependency conflicts, testing, or deployment approvals? Share the process challenge rather than details that could expose an unpatched website.
How to update promptly without skipping essential checks
There is another important detail: organizations using the Gin administration theme or Entity List module also need to review separate security updates. Updating core should not be treated as confirmation that every affected component has been patched.
- Confirm the scope. Identify the core branch and applicable contributed-project updates.
- Prepare recovery. Back up the database, files, and deployment configuration.
- Resolve and review dependencies. Check the proposed package changes in a development or staging environment.
- Apply the update and run required database updates.
- Test essential workflows and deploy promptly.
- Verify the running production version and review errors.
Use an expedited version of your established deployment process:Remote code execution can allow an attacker to run code on the affected system. That makes this a server-security concern, even if the website appears to be functioning normally.vendor/bin/drush updatedb
vendor/bin/drush cache:rebuild
Treat temporary protection as a way to reduce exposure while completing the update.
What should you verify after deployment?
These checks establish that the deployment is operating as expected. They are not proof that a site was never compromised.
- Confirm the patched core version in the running site.
- Check applicable Gin and Entity List versions.
- Test login, content editing, saving, and publishing.
- Check navigation and representative link fields.
- Verify important forms or transactions.
- Review application and server logs for new errors.
Drupal identifies 11.2.x and earlier Drupal 11 branches, and 10.5.x and earlier Drupal 10 branches, as outside security coverage. Those sites need a supported upgrade path, rather than waiting for a patch on their existing branch. Read the release guidance.Keep verification focused on the site’s essential operations:
What site owners should do now
For Composer-managed projects using drupal/core-recommended, the documented core update command is:Teams on 11.3.x or 10.6.x can apply the corresponding security release without making the move to Drupal 11.4 a prerequisite. The older supported branches also receive the CKEditor build update documented in their release notes. See the Drupal 11.3.19 and Drupal 10.6.19 release notes.A permission requirement narrows who can exploit a vulnerability. It does not replace the need for an update, particularly where accounts could be compromised or permissions are distributed across a large editorial team.
