CVE-2026-9082: Drupal Core SQL Injection (KEV)

Checked: 2026-10-29

CVE-2026-9082 is a SQL injection vulnerability in Drupal core's database abstraction API that lets an anonymous, unauthenticated attacker send a crafted request to inject arbitrary SQL against sites running on PostgreSQL, and CISA added it to the Known Exploited Vulnerabilities catalog days after Drupal's own advisory rated it "highly critical."

Vulnerability summary

Vulnerability ID	CVE-2026-9082
CVSS score	9.8
EPSS score	0.89381
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD (Drupal Security Team CNA Secondary score only, not NVD Primary)
Published	2026-05-20T20:16:41.230

Affected components

Component	CPE	Version range
Drupal core	cpe:2.3:a:drupal:drupal::::::::	8.9.0 through 10.4.9 (fixed in 10.4.10); 10.5.0 through 10.5.9 (fixed in 10.5.10); 10.6.0 through 10.6.8 (fixed in 10.6.9); 11.0.0 through 11.1.9 (fixed in 11.1.10); 11.2.0 through 11.2.11 (fixed in 11.2.12); 11.3.0 through 11.3.9 (fixed in 11.3.10); manual patches published for the unsupported Drupal 9.5 and 8.9 branches

What this means

CVE-2026-9082 (CWE-89, SQL injection) affects Drupal core. NVD's description states the flaw is an "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core," affecting core "from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10" (NVD).

Drupal's own security advisory SA-CORE-2026-004, published 2026-05-20 and updated 2026-05-22, rates the issue "Highly critical" with a risk score of 23/25 on Drupal's own NISTO-derived scale, and states the database abstraction API "did not sufficiently sanitize" input, letting attackers "send specially crafted requests, resulting in arbitrary SQL injection" for sites using PostgreSQL databases; the advisory notes anonymous users can exploit the issue and recommends updating Symfony and Twig dependencies as well, since those were fixed by coordinated upstream advisories released alongside SA-CORE-2026-004 (Drupal SA-CORE-2026-004).

NVD lists only a Secondary CVSS v3.1 submission from source [email protected] (the Drupal Security Team's CNA contact): base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD's vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published, so that 9.8 figure is labelled not NVD-confirmed on this page (NVD).

Fixed releases are Drupal 11.3.10, 11.2.12 and 11.1.10, and Drupal 10.6.9, 10.5.10 and 10.4.10; Drupal also published manual patches for the unsupported 9.5 and 8.9 branches rather than tagged releases (Drupal SA-CORE-2026-004).

CISA added CVE-2026-9082 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-05-22, with a required-action due date of 2026-05-27 — five days later — and records known ransomware-campaign use as "Unknown." Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.89381 (99.783th percentile), among the highest EPSS scores seen in this advisory set and consistent with a trivially reachable, unauthenticated SQL injection in widely deployed CMS software (FIRST EPSS).

Any Drupal site on PostgreSQL that has not applied the May 2026 security release should be updated to the fixed version for its branch immediately; sites on MySQL/MariaDB are lower risk per Drupal's advisory but should still update given the shared codebase and the coordinated Symfony/Twig fixes bundled in the same release.

How to fix this class of issueThis advisory's weakness class is SQL injection. Our practical guide covers how to detect, fix, verify and disclose it: How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware.

Evidence

SQL injection (CWE-89) in Drupal core's database abstraction API lets an anonymous attacker inject arbitrary SQL against PostgreSQL-backed sites via crafted requests. — NVD
Drupal SA-CORE-2026-004 rates the issue "Highly critical" (23/25), confirms anonymous exploitability on PostgreSQL, and recommends updating Symfony/Twig dependencies in the same release. — Drupal Security Advisory SA-CORE-2026-004
NVD lists only a Secondary CVSS v3.1 score of 9.8 (critical) from source [email protected], vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published, so the score is not NVD-confirmed. — NVD
Affected: Drupal core 8.9.0-10.4.9, 10.5.0-10.5.9, 10.6.0-10.6.8, 11.0.0-11.1.9, 11.2.0-11.2.11, 11.3.0-11.3.9; fixed in 10.4.10/10.5.10/10.6.9/11.1.10/11.2.12/11.3.10, with manual patches for 9.5 and 8.9. — Drupal Security Advisory SA-CORE-2026-004
Added to the CISA KEV catalog on 2026-05-22, required-action due date 2026-05-27, known ransomware campaign use recorded as Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
EPSS score is 0.89381 (99.783th percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2019-1068: Microsoft SQL Server RCE (KEV, re-added 2026)CVE-2019-1068: a 2019 Microsoft SQL Server remote code execution flaw CISA added to its KEV catalog in August 2026, seven years after patching, under its 2026 BOD 26-04 risk-based directive. Versions, scoring sourced to NVD and CISA KEV.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.