The Hacker Newspublished May 23, 13:25 UTC (May 23, 2026)ingested Sep 10, 05:53 UTC@TheHackersNews

Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

criticalExploit / PoC exploited in the wildimportance 60CVE-2026-9082

Read the original

Tagscve-2026-9082 exploit

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-9082	Actively Exploited SQL Injection in Drupal Core CVE-2026-9082 is a critical SQL injection flaw (CWE-89) in Drupal core caused by improper neutralization of special elements used in SQL commands, allowing user-controlled input to alter the queries the application executes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) shows it is remotely exploitable over the network without authentication, special privileges, or user interaction. A successful attacker gains high-impact access to the database (read, modify, or disrupt data), and news reports indicate PostgreSQL-backed sites may additionally be exposed to remote code execution. It affects Drupal core from version 8.9.0 onward across all current major lines, with fixes in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10, meaning essentially all unpatched modern Drupal deployments are at risk. The flaw is confirmed under active attack: CISA added it to the KEV catalog on 2026-05-22 and headlines report it is already being exploited in the wild, while EPSS assigns an 87.9% 30-day exploitation probability (100th percentile); no public proof-of-concept is known yet. Do: Upgrade Drupal core immediately to the patched release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10, or a later release as applicable, since the flaw is being actively exploited and carries an 87.9% EPSS. Prioritize internet-facing sites and deployments using a PostgreSQL database, which reports say can be pushed to remote code execution, and review web and database logs for signs of exploitation. Under the CISA KEV listing (added 2026-05-22), U.S. federal agencies must apply vendor mitigations per applicable BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.	9.8	88%	KEV	Drupal Core from 8.9.0 before 10.4.10 Drupal Core from 10.5.0 before 10.5.10 Drupal Core from 10.6.0 before 10.6.9 +3 more	masslikely hundreds of thousands to 1M+ sites worldwide (all modern Drupal core branches affected)	May 20, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-9082

Actively Exploited SQL Injection in Drupal Core

CVE-2026-9082 is a critical SQL injection flaw (CWE-89) in Drupal core caused by improper neutralization of special elements used in SQL commands, allowing user-controlled input to alter the queries the application executes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) shows it is remotely exploitable over the network without authentication, special privileges, or user interaction. A successful attacker gains high-impact access to the database (read, modify, or disrupt data), and news reports indicate PostgreSQL-backed sites may additionally be exposed to remote code execution. It affects Drupal core from version 8.9.0 onward across all current major lines, with fixes in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10, meaning essentially all unpatched modern Drupal deployments are at risk. The flaw is confirmed under active attack: CISA added it to the KEV catalog on 2026-05-22 and headlines report it is already being exploited in the wild, while EPSS assigns an 87.9% 30-day exploitation probability (100th percentile); no public proof-of-concept is known yet.

Do: Upgrade Drupal core immediately to the patched release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10, or a later release as applicable, since the flaw is being actively exploited and carries an 87.9% EPSS. Prioritize internet-facing sites and deployments using a PostgreSQL database, which reports say can be pushed to remote code execution, and review web and database logs for signs of exploitation. Under the CISA KEV listing (added 2026-05-22), U.S. federal agencies must apply vendor mitigations per applicable BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.

9.8

88%

KEV

Drupal Core from 8.9.0 before 10.4.10
Drupal Core from 10.5.0 before 10.5.10
Drupal Core from 10.6.0 before 10.6.9
+3 more

masslikely hundreds of thousands to 1M+ sites worldwide (all modern Drupal core branches affected)

May 20, 2026

Full article299 words · extracted from thehackernews.com · click to collapse

Ravie LakshmananMay 23, 2026Vulnerability / Website Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), an SQL injection vulnerability affecting all supported versions of Drupal Core.

"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API," CISA said.

News of exploitation arrives less than two days after Drupal released fixes for the flaw. Patches are available for the following versions -

Drupal 11.3.10
Drupal 11.2.12
Drupal 11.1.10
Drupal 10.6.9
Drupal 10.5.10
Drupal 10.4.10
Drupal 9.5 (Manual patching required)
Drupal 8.9 (Manual patching required)

In an update to its advisory on May 22, 2026, Drupal acknowledged that "exploit attempts are now being detected in the wild." Thales-owned Imperva said it has observed over 15,000 attack attempts targeting almost 6,000 individual sites across 65 countries.

"Attacks are primarily targeting gaming and financial services sites so far, at collectively almost 50% of all attacks," the company said. "Most of the observed activity so far appears to be probing."

"This pattern suggests attackers and scanners are primarily attempting to identify exposed Drupal sites running vulnerable PostgreSQL-backed configurations. While the activity is currently dominated by reconnaissance and validation, the nature of the vulnerability means successful exploitation could quickly move from probing to data extraction or privilege escalation."

Federal Civilian Executive Branch (FCEB) agencies have been recommended to apply the fixes by May 27, 2026, for optimal protection.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html