Skip to main content
IMMUNITYSEC

CVE-2026-9082

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

9.8
CRITICAL
CVSS 3.1
EPSS 15.7% · 97th pctCISA KEV · Exploited in the wildCWE-89
2026-05-20•Updated 2026-05-23•KEV 2026-05-22
CISA Known Exploited Vulnerabilities

Drupal Core SQL Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2026-05-22
Remediation due
2026-05-27

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
https://www.drupal.org/sa-core-2026-004 ; https://nvd.nist.gov/vuln/detail/CVE-2026-9082

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Severity

CVSS 3.1 · CNA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal

Affected Products

VendorProductAffected versions
DrupalDrupal core
8.9.0 to <10.4.10
10.5.0 to <10.5.10
10.6.0 to <10.6.9
11.0.0 to <11.1.10
11.2.0 to <11.2.12
11.3.0 to <11.3.10

References

1 Links

Record Details

Published
2026-05-20
Last updated
2026-05-23
Assigner (CNA)
drupal
Credited to
Michael Maturi (michaelmaturi); Björn Brala (bbrala); Benji Fisher (benjifisher); catch (catch); Lee Rowlands (larowlan); Dave Long (longwave); Drew Webber (mcdruid); Jess (xjm); Anna Kalata (akalata); Benji Fisher (benjifisher); catch (catch); Damien McKenna (damienmckenna); Neil Drumm (drumm); Greg Knaddison (greggles); Heine Deelstra (heine); Tim Hestenes Lehnen (hestenet); Dave Long (longwave); Drew Webber (mcdruid); Juraj Nemec (poker10); Pierre Rudloff (prudloff); Jess (xjm); Cathy Theys (yesct)

More from Drupal

CVE-2018-76028.1

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

CVE-2019-63408.1

Drupal core - Highly critical - Remote Code Execution

CVE-2020-136718.8

Drupal core Un-restricted Upload of File

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.