Drupal · Core
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
What it is
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
CISA: Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: May 27, 2026
- Added to the CISA list
- May 22, 2026
- Published
- May 20, 2026
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 89% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-89
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Drupal
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2022 | Remote Code Execution | Core | High 8.1 | 99.2% |
| Mar 25, 2022 | Remote Code Execution | Core | High 8.1 | 92% |
| Jan 18, 2022 | core Un-restricted Upload of File | Drupal core | High 8.8 | 36% |
| Nov 3, 2021 | Core Remote Code Execution | Drupal Core | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.