Log in Start free

Actively exploited · Published May 20, 2026 · Assigned by drupal

CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Critical 9.8 Exploited

In plain English

A critical-severity SQL injection in Drupal core from Drupal. Attackers are actively exploiting it in the wild (listed by CISA on May 22, 2026). The chance it is exploited in the next 30 days is estimated at 89.4% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)89.4%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since May 22, 2026
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by May 27, 2026.

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistdrupal/core10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10DRUPAL-CORE-2026-004
Packagistdrupal/core10.4.10GHSA-ghwc-95x2-682j
Packagistdrupal/core10.5.10GHSA-ghwc-95x2-682j
Packagistdrupal/core10.6.9GHSA-ghwc-95x2-682j
Packagistdrupal/core11.1.10GHSA-ghwc-95x2-682j
Packagistdrupal/core11.2.12GHSA-ghwc-95x2-682j
Packagistdrupal/core11.3.10GHSA-ghwc-95x2-682j

Affected products (as reported)

VendorProductVersions
Drupal Drupal core 8.9.0 – before 10.4.1010.5.0 – before 10.5.1010.6.0 – before 10.6.911.0.0 – before 11.1.1011.2.0 – before 11.2.1211.3.0 – before 11.3.10

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References