Full Report
Drupal is warning that hackers are attempting to exploit a "highly critical" SQL injection vulnerability announced earlier this week. [...]
Analysis Summary
# Vulnerability: Drupal Core - Highly Critical SQL Injection
## CVE Details
- **CVE ID:** CVE-2026-9082
- **CVSS Score:** 6.5 (Medium) via NIST / 23/25 (Highly Critical) via Drupal
- **CWE:** CWE-89 (SQL Injection)
## Affected Systems
- **Products:** Drupal CMS (using PostgreSQL database backend)
- **Versions:**
- Drupal 8.9.x (End-of-Life, patch provided best-effort)
- Drupal 10.4.x before 10.4.10
- Drupal 10.5.x before 10.5.10
- Drupal 10.6.x before 10.6.9
- Drupal 11.0.x / 11.1.x before 11.1.10
- Drupal 11.2.x before 11.2.12
- Drupal 11.3.x before 11.3.10
- **Configurations:** Systems specifically utilizing **PostgreSQL** as the database backend are at primary risk for the SQL injection, though all users are advised to update due to bundled dependency fixes.
## Vulnerability Description
The flaw resides in Drupal’s database abstraction API. It allows an attacker to send specially crafted requests that bypass sanitization, triggering arbitrary SQL injection. Due to the nature of the database interaction, this flaw can lead to unauthorized data access, privilege escalation, and potentially remote code execution (RCE) on the underlying host.
## Exploitation
- **Status:** Exploited in the wild (Confirmed by Drupal PSA as of May 22, 2026)
- **Complexity:** Low (Targeted via specially crafted requests)
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Full database access and information disclosure)
- **Integrity:** High (Modification of database content and privilege escalation)
- **Availability:** High (Potential for data deletion or system-wide disruption)
## Remediation
### Patches
Update to the following versions immediately:
- Drupal 10.4.10+
- Drupal 10.5.10+
- Drupal 10.6.9+
- Drupal 11.1.10+
- Drupal 11.2.12+
- Drupal 11.3.10+
### Workarounds
- There are no primary functional workarounds other than patching.
- Migrating away from PostgreSQL could theoretically mitigate the specific SQLi, but is not recommended over updating, as updates also contain security fixes for Symfony and Twig.
## Detection
- **Indicators of Compromise:** Review web server access logs for unusual queries or patterns involving database API calls. Monitor for unexpected administrative account creation or modified system settings.
- **Detection methods and tools:** Database activity monitoring (DAM) for anomalous PostgreSQL queries. Standard vulnerability scanners may identify outdated Drupal versions.
## References
- **Vendor Advisory:** hxxps[://]www[.]drupal[.]org/sa-core-2026-004
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-9082
- **Related News:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/drupal-critical-update-to-fix-bug-with-high-exploitation-risk/