CVE-2026-9082: Critical SQL Injection in Drupal Core — Update Now

CVE-2026-9082: Critical SQL Injection in Drupal Core — Update Now

In short

On May 20, 2026, CVE-2026-9082 [1] was published, an SQL injection vulnerability in Drupal Core with a CVSS score of 9.8 out of 10 and Critical severity according to the NVD [1]. It affects organizations that use Drupal as a content management system and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [2], confirming that it is already being actively exploited. If your website or intranet runs on Drupal, update Drupal Core today.

---

What it is and why it matters

SQL injection is one of the oldest attack techniques and, at the same time, one of the most devastating: an attacker inserts malicious commands into the queries an application sends to its database. In this case, the vulnerability resides in the database abstraction API at the core of Drupal, which means the flaw is not in a third-party module that you can simply disable, but at the very heart of the system.

According to OCIRIA's analysis, successful exploitation allows privilege escalation and remote code execution: an external attacker could, without needing valid credentials, read and modify the entire database, create administrator users, or install malicious code on the server. The potential impact ranges from the leakage of customer data to the total compromise of the site and the systems connected to it.

The severity is not a subjective assessment: the official CVSS score of 9.8 [1] places it at the highest threshold of the scale, and its inclusion in CISA's KEV catalog [2] confirms that attackers are already exploiting this vulnerability in real-world environments.

---

Who is affected

The vulnerability is present in the following versions of Drupal Core [1]:

• From 8.9.0 to before 10.4.10
• From 10.5.0 to before 10.5.10
• From 10.6.0 to before 10.6.9
• From 11.0.0 to before 11.1.10
• From 11.2.0 to before 11.2.12
• From 11.3.0 to before 11.3.10

In practice, this affects any organization — company, public administration, small business, association — that publishes content, manages an online store, an intranet, or any portal built on Drupal without having applied the corresponding patches. Drupal is one of the most widely used content management systems in Spain in corporate and institutional environments.

---

How to know if you are vulnerable

The first step is to find out which version of Drupal Core is installed in each of your environments (production, pre-production, development). You can check this in the Drupal administration panel, at the path /admin/reports/status, or by asking your hosting or web development provider directly.

Compare the installed version with the affected ranges published by the NVD [1]. If your version falls within any of those ranges and you have not yet applied the patch, you should consider yourself exposed. It is also advisable to review the web server and database access logs for anomalous query patterns that could indicate previous exploitation attempts.

Reviewing your organization's internet-exposed attack surface — which services and applications are accessible from outside — is a fundamental step in prioritizing where to act first.

---

How to protect yourself

1. Update Drupal Core immediately to the patched version corresponding to your branch [1]. This is the only definitive measure and should not be delayed.

2. Audit recent database access. Check whether there were unusual queries, unauthorized user creation, or system configuration changes since the publication date (May 20, 2026) [1].

3. Restrict access to the Drupal administration panel by IP or through two-factor authentication while the update is being prepared.

4. Coordinate with your provider if Drupal maintenance is outsourced: demand written confirmation that the patch has been applied and on what date.

5. Review third-party modules to ensure they are also up to date; although the main vulnerability is in the core, outdated modules expand the risk surface.

6. Consider a WAF (web application firewall) as an additional containment measure, not as a substitute for the patch.

---

Frequently asked questions

Is it urgent if my website doesn't have sensitive data?

Yes. Even a seemingly simple website can serve as an entry point for attacking other internal systems, sending spam, or hosting malicious content that damages your reputation.

Is it enough to make a backup?

A backup is necessary before updating, but it does not protect against the attack: it only allows you to recover if something goes wrong during the update.

Does my hosting provider apply the patch automatically?

It depends on the provider and the contract. Don't assume it: request explicit confirmation.

How do I know if I have already been compromised?

The signs can be subtle. Review administrative access, new users, and unauthorized content changes. If in doubt, request a forensic review before applying the patch.

Sources

• [1] NVD — Official record for CVE-2026-9082: nvd.nist.gov/vuln/detail/CVE-2026-9082
• [2] CISA — Known Exploited Vulnerabilities (KEV) catalog: cisa.gov/known-exploited-vulnerabilities-catalog