CVE-2026-9082

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - mlhess@drupal.org

Published

2026-05-20

Last modified

2026-10-07

Known exploited (CISA KEV)

since 2026-05-22, action due 2026-05-27: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-89

Affected products

• Drupal (Drupal)
• Drupal Core (Drupal)

References

• https://www.drupal.org/sa-core-2026-004
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082