by Kastro
Paper/Archive/CVE-2026-9082

CVE-2026-9082

Drupal Drupal core — Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

KEV · due 27 MayEPSS 89%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Affected

ProductAffectedFixed inSource
Drupal core8.9.0 – < 10.4.1010.4.10CNA
Drupal core10.5.0 – < 10.5.1010.5.10CNA
Drupal core10.6.0 – < 10.6.910.6.9CNA
Drupal core11.0.0 – < 11.1.1011.1.10CNA
Drupal core11.2.0 – < 11.2.1211.2.12CNA
Drupal core11.3.0 – < 11.3.1011.3.10CNA

Scores by source

drupal (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refdrupal.org/sa-core-2026-004refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082kevcisa.gov/known-exploited-vulnerabilities-catalog