In CISA KEV9.8 CriticalCWE-89
CVE-2026-9082
Drupal Core SQL Injection Vulnerability
DrupalCore
Status
- Exploited in the wild
- In CISA KEV since 22 May
- Vendor fix available
Federal deadlineWed 27 May, 23:59 UTC
Passed 150 days ago
CISA KEV · added 22 May
Exploit probabilityEPSSchecked 25 Oct
89%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 8 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 21 May · 11:01 UTC | SecurityWeek | Drupal patches PostgreSQL SQL injection flaw CVE-2026-9082 |
| Fri 22 May · 17:32 UTC | SecurityWeek | Drupal Critical SQL Flaw CVE-2026-9082 Prompts Urgent Patch |
| Fri 22 May · 19:31 UTC | CISA | Drupal Core Critical Flaw CVE-2026-9082 Allows RCE |
| Fri 22 May · 23:05 UTC | CISA | CISA Flags Drupal SQL Injection Flaw CVE-2026-9082 in KEV Catalog |
| Sat 23 May · 17:30 UTC | Security Affairs | Critical Drupal SQLi flaw exposes thousands of PostgreSQL sites |
| Sun 24 May · 08:31 UTC | Security Affairs | CISA adds Drupal SQL flaw CVE-2026-9082 to KEV catalogue |
| Sun 24 May · 12:31 UTC | Security Affairs | Drupal SQL Injection Bug Exploited Live, Extortion Tactics Surge |
| Mon 25 May · 10:32 UTC | SecurityOnline | Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat |
- Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running TyposquatSecurityOnline
- Drupal SQL Injection Bug Exploited Live, Extortion Tactics SurgeSecurity Affairs
- CISA adds Drupal SQL flaw CVE-2026-9082 to KEV catalogueSecurity Affairs
- Critical Drupal SQLi flaw exposes thousands of PostgreSQL sitesSecurity Affairs
- CISA Flags Drupal SQL Injection Flaw CVE-2026-9082 in KEV CatalogCISA · official notice
- Drupal Core Critical Flaw CVE-2026-9082 Allows RCECISA · official notice
- Drupal Critical SQL Flaw CVE-2026-9082 Prompts Urgent PatchSecurityWeek
- Drupal patches PostgreSQL SQL injection flaw CVE-2026-9082SecurityWeek · first in our coverage