CVE-2026-9082

CVE-2026-9082 is a critical SQL injection flaw (CWE-89) in Drupal core caused by improper neutralization of special elements used in SQL commands, allowing user-controlled input to alter the queries the application executes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) shows it is remotely exploitable over the network without authentication, special privileges, or user interaction. A successful attacker gains high-impact access to the database (read, modify, or disrupt data), and news reports indicate PostgreSQL-backed sites may additionally be exposed to remote code execution. It affects Drupal core from version 8.9.0 onward across all current major lines, with fixes in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10, meaning essentially all unpatched modern Drupal deployments are at risk. The flaw is confirmed under active attack: CISA added it to the KEV catalog on 2026-05-22 and headlines report it is already being exploited in the wild, while EPSS assigns an 87.9% 30-day exploitation probability (100th percentile); no public proof-of-concept is known yet.

What to do: Upgrade Drupal core immediately to the patched release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10, or a later release as applicable, since the flaw is being actively exploited and carries an 87.9% EPSS. Prioritize internet-facing sites and deployments using a PostgreSQL database, which reports say can be pushed to remote code execution, and review web and database logs for signs of exploitation. Under the CISA KEV listing (added 2026-05-22), U.S. federal agencies must apply vendor mitigations per applicable BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.