MSRXVulnerabilities / CVE-2026-9082
CVE-2026-9082
Published 2026-05-20 · Analyzed
CVE-2026-9082
Drupal Core SQL Injection Vulnerability
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-22, with a fix-by date of 2026-05-27. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
9.8 CRITICAL
CVSS 3.1 · CNA · drupal.org
CVSS 3.1 · CNA · drupal.org
89%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Scores
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| drupal/core | Packagist | 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 |
Affected products
- drupal drupal: ≥ 8.9.0, < 10.4.10; ≥ 10.5.0, < 10.5.10; ≥ 10.6.0, < 10.6.9; ≥ 11.0.0, < 11.1.10; ≥ 11.2.0, < 11.2.12; ≥ 11.3.0, < 11.3.10
Weakness: CWE-89
Also known as: BIT-drupal-2026-9082, DRUPAL-CORE-2026-004, GHSA-ghwc-95x2-682j
2 references (advisories, patches, write-ups)
- https://www.drupal.org/sa-core-2026-004 · Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082 · US Government Resource
Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.