Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Only Drupal core sites using PostgreSQL databases are affected, in versions from 8.9.0 up to each branch's fix. Fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
Drupal core, the content management system's foundational software, is affected across many released branches from version 8.9 through 11.3. The flaw is an SQL injection vulnerability that could let an attacker manipulate database queries, potentially allowing unauthorized access to, modification of, or deletion of site data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- CISA remediation deadline
Due date for US federal agencies to patch
- Public exploit on Exploit-DB
EDB-52608
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Drupal Drupal core
From 8.9.0 · fixed in 10.4.10; From 10.5.0 · fixed in 10.5.10; From 10.6.0 · fixed in 10.6.9; From 11.0.0 · fixed in 11.1.10; From 11.2.0 · fixed in 11.2.12; From 11.3.0 · fixed in 11.3.10
- drupalBitnami
From 8.9.0 · fixed in 10.4.10; From 10.5.0 · fixed in 10.5.10; From 10.6.0 · fixed in 10.6.9; From 11.0.0 · fixed in 11.1.10; From 11.2.0 · fixed in 11.2.12; From 11.3.0 · fixed in 11.3.10
- drupal/corePackagist
From 8.9.0 · fixed in 10.4.10; From 10.5.0 · fixed in 10.5.10; From 10.6.0 · fixed in 10.6.9; From 11.0.0 · fixed in 11.1.10; From 11.2.0 · fixed in 11.2.12; From 11.3.0 · fixed in 11.3.10
- drupal/corePackagist
From 8.9.0 · fixed in 10.4.10
- drupal/corePackagist
From 10.5.0 · fixed in 10.5.10
- drupal/corePackagist
From 10.6.0 · fixed in 10.6.9
- drupal/corePackagist
From 11.0.0 · fixed in 11.1.10
- drupal/corePackagist
From 11.2.0 · fixed in 11.2.12
- drupal/corePackagist
From 11.3.0 · fixed in 11.3.10
References 2
drupal.org
Exploit-DB
Questions about CVE-2026-9082
What does this mean?
This SQL injection flaw lets arbitrary SQL be injected into database queries on PostgreSQL sites. Its listed impact is information disclosure and, in some cases, privilege escalation, remote code execution, or other attacks.Source: drupal.org
Am I affected, and how do I check?
Only sites using PostgreSQL databases are affected. The affected range runs from 8.9.0 up to the fixed release on each branch: before 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10. To check a version, look at the Drupal core version on the status report page or run composer show drupal/core.Source: drupal.org
What should I do about it?
Update Drupal core to the fixed release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10. The advisory says that for Drupal 11.3.x, the update target is 11.3.10.Source: drupal.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-22, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).Source: cisa.gov, cve.now feed data