SecurityWeekEduard Kovacs
Drupal Critical SQL Flaw CVE-2026-9082 Prompts Urgent Patch
Drupal has issued a warning regarding CVE-2026-9082, a critical vulnerability that impacts its API for database query sanitization, potentially allowing SQL injection attacks. This flaw can be exploited by unauthenticated attackers, leading to information exposure, privilege escalation, or remote code execution. Approximately 5% of Drupal sites using PostgreSQL might be affected, prompting a quick patch release on May 20.
An uptick in exploitation attempts has been observed, with over 15,000 targeting nearly 6,000 sites globally, predominantly in gaming and financial sectors. Despite the rarity of highly critical vulnerabilities in Drupal in recent years, the risk level for CVE-2026-9082 has now increased, indicating urgent action needed from affected site administrators.
Story timeline CVE-2026-9082
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 21 May · 11:01 UTC | SecurityWeek | Drupal patches PostgreSQL SQL injection flaw CVE-2026-9082 |
| Fri 22 May · 17:32 UTC | SecurityWeek | Drupal Critical SQL Flaw CVE-2026-9082 Prompts Urgent Patch (this article) |
| Fri 22 May · 19:31 UTC | CISA | Drupal Core Critical Flaw CVE-2026-9082 Allows RCE |
| Fri 22 May · 23:05 UTC | CISA | CISA Flags Drupal SQL Injection Flaw CVE-2026-9082 in KEV Catalog |
| Sat 23 May · 17:30 UTC | Security Affairs | Critical Drupal SQLi flaw exposes thousands of PostgreSQL sites |
| Sun 24 May · 08:31 UTC | Security Affairs | CISA adds Drupal SQL flaw CVE-2026-9082 to KEV catalogue |
| Sun 24 May · 12:31 UTC | Security Affairs | Drupal SQL Injection Bug Exploited Live, Extortion Tactics Surge |
| Mon 25 May · 10:32 UTC | SecurityOnline | Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat |