SQL injection in Drupal - CVE-2026-9082
Published: May 21, 2026 / Updated: August 26, 2026
Vulnerability identifier: #VU132032
CSH Severity: Critical
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-9082
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries.
The vulnerability exists due to improper input validation in the database abstraction API when handling specially crafted requests. A remote attacker can send a specially crafted request to perform arbitrary SQL injection.
Only sites using PostgreSQL databases are vulnerable. Anonymous exploitation is possible. Successful exploitation can lead to information disclosure and, in some cases, privilege escalation or remote code execution.
Affected software
Drupal
How to mitigate CVE-2026-9082
Install security update from vendor's website.
Drupal - addressed in versions 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10