critical9.8Known exploitedPublic exploit code
CVE-2026-9082
Drupal Core SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-05-22. Federal due date: 2026-05-27.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Drupal Core 10.5.5 - Error-Based SQL Injection2026-06-01 · webapps · php
Impact
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | drupal/core | >= 8.9.0, < 10.4.10 | 10.4.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | from 8.9.0 before 10.4.10 from 10.5.0 before 10.5.10 from 10.6.0 before 10.6.9 from 11.0.0 before 11.1.10 from 11.2.0 before 11.2.12 from 11.3.0 before 11.3.10 |