SecurityWeekEduard Kovacs
Drupal patches PostgreSQL SQL injection flaw CVE-2026-9082
Drupal has addressed a highly critical vulnerability (CVE-2026-9082) in its CMS, which could allow attackers to exploit PostgreSQL databases through crafted requests, leading to SQL injection risks. The flaw can be exploited without authentication, enabling information retrieval and potential privilege escalation. Patches are available for various Drupal versions, and it is advised to update all dependencies, as other vulnerabilities in Symfony and Twig were also addressed. This is the first highly critical vulnerability in years, contrasting with previous major vulnerabilities like 'Drupalgeddon.'
Story timeline CVE-2026-9082
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 21 May · 11:01 UTC | SecurityWeek | Drupal patches PostgreSQL SQL injection flaw CVE-2026-9082 (this article) |
| Fri 22 May · 17:32 UTC | SecurityWeek | Drupal Critical SQL Flaw CVE-2026-9082 Prompts Urgent Patch |
| Fri 22 May · 19:31 UTC | CISA | Drupal Core Critical Flaw CVE-2026-9082 Allows RCE |
| Fri 22 May · 23:05 UTC | CISA | CISA Flags Drupal SQL Injection Flaw CVE-2026-9082 in KEV Catalog |
| Sat 23 May · 17:30 UTC | Security Affairs | Critical Drupal SQLi flaw exposes thousands of PostgreSQL sites |
| Sun 24 May · 08:31 UTC | Security Affairs | CISA adds Drupal SQL flaw CVE-2026-9082 to KEV catalogue |
| Sun 24 May · 12:31 UTC | Security Affairs | Drupal SQL Injection Bug Exploited Live, Extortion Tactics Surge |
| Mon 25 May · 10:32 UTC | SecurityOnline | Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat |