Critical SQL Injection Vulnerability in Drupal Core Actively Exploited

Thehackernews

Critical SQL Injection Vulnerability in Drupal Core Actively Exploited

First seen 25 May 2026, 07:31 UTC • •80.3

Article Content

1 / 7

Browse articles

ThreatCluster •May 26, 2026 at 07:05 UTC

•CVE-2026-9082 is a critical SQL injection vulnerability in Drupal Core with a CVSS score of 9.8.
•The vulnerability allows unauthenticated attackers to execute malicious SQL queries, risking data exposure.
•CISA has confirmed active exploitation and added the vulnerability to its Known Exploited Vulnerabilities catalog.

A critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core has been identified, affecting multiple supported versions. The vulnerability, with a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary SQL queries, leading to potential information disclosure and privilege escalation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that this flaw is being actively exploited in the wild and has added it to its Known Exploited Vulnerabilities (KEV) catalog. Users of affected Drupal versions are urged to update immediately to the latest patched versions to mitigate risks. The vulnerability impacts Drupal core versions from 8.9.0 to 11.3.10. CISA's alert emphasizes the urgency of addressing this flaw to protect organizations from potential attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 143d ago How this analysis works

Timeline

2026-05-20

CVE-2026-9082 published

A critical SQL injection vulnerability in Drupal Core was disclosed, affecting multiple versions.

2026-05-21

First public PoC released

A proof of concept for the SQL injection vulnerability was made publicly available, increasing risk.

Date unknown

2026-05-22

CVE added to CISA KEV catalog

CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalog due to active exploitation.

2026-05-25

CISA issues urgent alert

CISA warned organizations about the active exploitation of the SQL injection vulnerability in Drupal Core.

Cybersecuritynews

2026-05-26

Security update released

Drupal security team released updates to patch the critical SQL injection vulnerability, urging immediate application.

More articles in this cluster (6)

Threat Graph

6 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Sql Injection
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-9082

Weakness (1)

CWE-89 - SQL Injection

Affected Platform (2)

Drupal
Drupal Core

Relationships

CVE-2026-9082 targets Drupal
CVE-2026-9082 targets Drupal Core
Sql Injection targets Drupal
Sql Injection targets Drupal Core
T1190 - Exploit Public-Facing Application targets Drupal
T1190 - Exploit Public-Facing Application targets Drupal Core
CVE-2026-9082 related to CWE-89 - SQL Injection

Following this threat?

Track CVE-2026-9082 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…