CVE-2026-9082KEV · OVERDUECWE-89sql-injection

Drupal Core SQL Injection Vulnerability

Critical · published May 21, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 96.9th percentile for exploit probability.

149
days past CISA
deadline
CVSS v3.1
9.8
EPSS
16%
Percentile
96.9
In the wild
Confirmed
What it is

🚨 A sneaky SQL injection vulnerability lurks in multiple versions of Drupal core, making it alarmingly easy for attackers to manipulate your database! 🔥 Imagine a restaurant where customers can write their own orders on the menu without the chef checking the ingredients. This SQL injection flaw allows an attacker to issue commands directly to the database, crafting malicious queries that can wreak havoc with your data. An attacker can gain unauthorized access, read sensitive data, modify records, or even delete your entire database! This could lead to devastating data breaches, loss of customer trust, and significant operational disruptions—absolutely catastrophic for any organization!

Put simply

Imagine a restaurant where customers can write their own orders on the menu without the chef checking the ingredients. This SQL injection flaw allows an attacker to issue commands directly to the database, crafting malicious queries that can wreak havoc with your data. This vulnerability in Drupal core allows attackers to exploit improper handling of special elements in SQL commands, leading to SQL injection attacks. Affected versions include 8.9.0 prior to 10.4.10, and various branches before their respective patched releases.

What to do

An attacker can gain unauthorized access, read sensitive data, modify records, or even delete your entire database! This could lead to devastating data breaches, loss of customer trust, and significant operational disruptions—absolutely catastrophic for any organization! Update your Drupal core immediately to the latest versions: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10. Additionally, review all SQL queries to ensure proper parameterization and validation to prevent further vulnerabilities. You've got this! Follow these steps, patch up, and you'll have your site fortified in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15701 · 96.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-21T00:16Z
KEV added
2026-05-22 · due 2026-05-27
Affected products (6)
ProductVersionsFixed in
drupal/drupal≥ 8.9.0, < 10.4.1010.4.10
drupal/drupal≥ 10.5.0, < 10.5.1010.5.10
drupal/drupal≥ 10.6.0, < 10.6.910.6.9
drupal/drupal≥ 11.0.0, < 11.1.1011.1.10
drupal/drupal≥ 11.2.0, < 11.2.1211.2.12
drupal/drupal≥ 11.3.0, < 11.3.1011.3.10
References (2)
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved 90% → 16%
    epss
  • 22 MAY 00:00Z
    Added to CISA KEV — remediate by May 27
    kev
  • 20 MAY 18:20Z
    Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
    cvelistv5