CVE-2026-9082

Critical9.8 Published on May 20, 2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since May 22, 2026
US federal agencies must remediate it by May 27, 2026 (BOD 22-01)
First attack observed 1 day after disclosure
Confirmed by sensors, not only by reports

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Jun 11, 2026 May 25, 2026 May 22, 2026 May 22, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-89

Vendorsdrupal