CRITICAL Actively exploited CWE-89
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Drupal·Core
9.8/ 10
CVSS 3.1
Critical severity
89%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.8% of all CVEs
Listed
CISA KEV catalog
- Added
- May 22, 2026
- Fix due
- May 27, 2026
- Ransomware
- Not known
Timeline
- Published
- May 20, 2026
- Updated
- Oct 7, 2026
- First covered
- Oct 30, 2026
- Latest story
- 2 weeks ago
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Drupal core8.9.0 to before 10.4.1010.5.0 to before 10.5.1010.6.0 to before 10.6.911.0.0 to before 11.1.10