CVE-2026-9082

Published May 20, 2026

Last updated 22 days ago

Exploit known CVSS critical 9.8

Zero-day

SQL injection

Database

Drupal Core

Drupal

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-9082 is a SQL injection vulnerability found within the database abstraction API of Drupal core. This flaw specifically impacts Drupal websites that utilize PostgreSQL databases. An attacker can exploit this vulnerability by sending specially crafted requests, which can lead to arbitrary SQL injection. Successful exploitation of CVE-2026-9082 can result in information disclosure, and in some cases, privilege escalation or remote code execution. This vulnerability can be exploited by anonymous users. The security updates released for this issue also include fixes for upstream dependencies like Symfony and Twig.

Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Source: mlhess@drupal.org
NVD status: Analyzed
Products: drupal

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Drupal Core SQL Injection Vulnerability
Exploit added on: May 22, 2026
Exploit action due: May 27, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

mlhess@drupal.org: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D913070F-48D6-4282-8F54-72F40C57EFE9",
            "versionEndExcluding": "10.4.10",
            "versionStartIncluding": "8.9.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "358B0EE2-C620-4B3C-ACF3-A0537BF3DCD9",
            "versionEndExcluding": "10.5.10",
            "versionStartIncluding": "10.5.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "27F0A477-45CF-4670-A40B-C45EF45DDFD8",
            "versionEndExcluding": "10.6.9",
            "versionStartIncluding": "10.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2CA9EE15-B47E-416A-9486-8A3CA815EF22",
            "versionEndExcluding": "11.1.10",
            "versionStartIncluding": "11.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F34F68CB-E0D0-4F30-9B8C-7A51BF285F26",
            "versionEndExcluding": "11.2.12",
            "versionStartIncluding": "11.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C878524F-B5D0-4894-81BD-6E17AFB30A4A",
            "versionEndExcluding": "11.3.10",
            "versionStartIncluding": "11.3.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.