CVE-2026-9082
Drupal Core SQL Injection Vulnerability
Description
CVE-2026-9082 is a critical-severity SQL injection vulnerability in Drupal core, one of the most widely deployed open-source content management systems. The flaw lives in Drupal's database abstraction API and lets an attacker send specially crafted requests that inject malicious SQL, which can lead to privilege escalation and remote code execution. With a maximum CVSS score of 9.8, no authentication required, and an EPSS score in the 95th percentile, CVE-2026-9082 represents an immediate threat to any internet-facing Drupal site. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and the SQL injection flaw should be patched without delay because it can hand an attacker full control of the site and its database.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| drupal | drupal | >= 8.9.0, < 10.4.10; >= 10.5.0, < 10.5.10; >= 10.6.0, < 10.6.9; >= 11.0.0, < 11.1.10; >= 11.2.0, < 11.2.12; >= 11.3.0, < 11.3.10 |
References
- https://www.drupal.org/sa-core-2026-004(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
In Drupal core, SQL injection occurs when user-controllable input reaches the database abstraction API without proper neutralization, allowing crafted requests to alter the structure of the executed SQL query. Because Drupal's database layer is used pervasively throughout the application, this single weakness can be reached from many request paths and leveraged for privilege escalation and remote code execution.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact Analysis
CVE-2026-9082 carries a CVSS 3.1 score of 9.8 (CRITICAL), the most severe combination short of a scope change. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, and fully compromises the confidentiality, integrity, and availability of the affected site. A successful SQL injection against Drupal's database abstraction API can read or modify any data in the database, bypass authentication, escalate to administrative privileges, and ultimately achieve remote code execution on the server. With an EPSS score of 17.3% (95th percentile) and a CISA KEV listing, exploitation is highly likely and administrators of internet-facing Drupal sites should treat this as an emergency patch.
Exploit Maturity
CVE-2026-9082 is listed on the CISA Known Exploited Vulnerabilities catalog, indicating CISA has flagged it for confirmed or imminent active exploitation, and the EPSS score of 17.3% (95th percentile) reinforces a high probability of attacks in the near term. The Drupal security team has published advisory SA-CORE-2026-004 with patched releases. No tagged public proof-of-concept exploit appears in the NVD references yet, but unauthenticated SQL injection in a CMS as widely deployed as Drupal is a prime target for rapid weaponization and mass scanning, so the absence of a public PoC should not be read as safety. Apply the patch immediately and monitor for exploitation rather than waiting for a public exploit to surface.
Remediation
- Apply updates immediately per the Drupal security advisory SA-CORE-2026-004: upgrade Drupal core to 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10 depending on your branch — all earlier releases from 8.9.0 onward are affected.
- If you cannot patch immediately, place the site behind a web application firewall with rules tuned to detect SQL injection patterns against Drupal endpoints, and restrict access to the affected request paths where feasible.
- Because exploitation can lead to privilege escalation and remote code execution, audit user accounts for unexpected administrator roles, review the database for unauthorized changes, and inspect the filesystem for webshells or modified PHP files after patching.
- Review database query logs and web server logs for anomalous requests to the database abstraction API and for SQL error patterns that may indicate exploitation attempts.
- As long-term hardening against SQL injection, ensure all custom and contributed modules use Drupal's parameterized query APIs (placeholders, the database abstraction layer) rather than concatenating user input into SQL, and keep core and contrib modules on supported, patched versions.
Technical Details
CVE-2026-9082 is an improper neutralization of special elements used in an SQL command (CWE-89) within Drupal core's database abstraction API. When user-controllable input is incorporated into a query without correct escaping or parameterization, an attacker can inject SQL syntax that changes the meaning of the query, enabling data exfiltration, authentication bypass, privilege escalation, and — through Drupal's plugin and configuration mechanisms — remote code execution. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) shows the path is network-accessible, requires no special conditions, demands no authentication, and yields full impact to confidentiality, integrity, and availability. The flaw affects a broad span of releases — from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 — making version identification and prompt upgrading essential.
Frequently Asked Questions
Is CVE-2026-9082 being actively exploited?
CVE-2026-9082 is listed on the CISA Known Exploited Vulnerabilities catalog, and its EPSS score of 17.3% places it in the 95th percentile for exploitation likelihood. Unauthenticated SQL injection in Drupal is a high-value target, so active exploitation and mass scanning should be assumed.
What products are affected by CVE-2026-9082?
CVE-2026-9082 affects Drupal core across multiple branches: from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10. Sites on any of these versions should patch immediately.
How do I fix CVE-2026-9082?
Upgrade Drupal core to the fixed release for your branch (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10) as described in Drupal advisory SA-CORE-2026-004. As an interim measure, deploy WAF rules to block SQL injection patterns and then audit for signs of prior compromise.
How severe is CVE-2026-9082?
CVE-2026-9082 is rated CRITICAL with a CVSS 3.1 score of 9.8. It requires no authentication and can be exploited remotely to read or modify the entire database, escalate privileges, and achieve remote code execution, making it one of the most dangerous Drupal vulnerabilities in recent years.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.