Intel

CVE-2026-9082

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

criticalKEV: actively exploitedPoCEPSS 88%

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Source: OSVOSVOSVEUVDCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2026-9082 scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with an EPSS percentile of 99.8 %, placing it among the most likely-to-be-exploited vulnerabilities tracked. The unauthenticated, network-reachable attack path leading directly to privilege escalation and remote code execution makes this a critical-priority item regardless of organisational size. Drupal is widely deployed across NIS2-regulated sectors — government portals, healthcare, and critical infrastructure — making exposed instances high-value targets. Organisations running any affected branch, and especially those still on end-of-life Drupal 8.x where no patch will be issued, must treat this as P1 and either patch or isolate within the 0-24 h window; compensating controls alone are insufficient for internet-facing deployments.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Upgrade Drupal Core to a fixed version — 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10 depending on your active branch. Patch available from the vendor — verify the exact package version and Drupal Security Advisory at https://www.drupal.org/security.
  • Isolate Drupal 8.9.x instances: Drupal 8.x is end-of-life and will not receive a security patch. Take affected systems offline or place them behind a WAF in blocking mode immediately until migration to a supported branch is complete.
  • Review recent HTTP traffic for exploitation attempts: Audit web server and WAF logs for the past 72 hours for SQL injection patterns in request parameters — URL-encoded special characters (%27, UNION, SELECT, --) especially on endpoints that interact with Drupal's database abstraction layer.
  • Restrict and rotate database credentials: Confirm the Drupal database user holds only the minimum required privileges (no FILE, SUPER, or GRANT OPTION). Rotate the database user password immediately.
  • Audit Drupal administrator accounts: Check /admin/people for any unauthorised account creation or privilege escalation to the administrator role. Disable suspicious accounts immediately.
  • Create an offline backup: Take a clean database backup before patching to preserve a known-good restore point.

Runbook · Step 2

Mitigation layers

  • WAF rule (network layer): Enable ModSecurity or equivalent WAF signatures blocking SQL injection payloads in POST bodies and query strings (OWASP CRS 942xxx rule group). Set blocking mode explicitly for Drupal API endpoints (/jsonapi/, /api/, ?q=).
  • Network segmentation: Restrict outbound connections from the Drupal web server to only the database port (TCP 3306 for MySQL/MariaDB, TCP 5432 for PostgreSQL) toward the database host. Block all other outbound connections from the web tier to limit post-exploitation pivoting.
  • PHP hardening: Extend disable_functions in php.ini to include exec, shell_exec, system, passthru, popen to raise the bar for RCE following a successful injection. Restrict open_basedir to the Drupal webroot.
  • Least-privilege database user: Limit the Drupal DB user to SELECT, INSERT, UPDATE, DELETE on the Drupal schema only. Revoke DROP, CREATE, ALTER, and FILE to prevent file-write operations via SQL (INTO OUTFILE).
  • Disable unused API modules: If JSON:API or the REST module is not required in production, uninstall them (drush pm:uninstall jsonapi rest) to reduce the attack surface.
  • Enforce Trusted Host Settings: Ensure trusted_host_patterns is correctly configured in settings.php to eliminate Host header injection as an additional attack vector.

Runbook · Step 3

Detection rules

  • Web server access log (Apache/Nginx): Search for SQL injection indicators in request URIs and POST bodies: SPL: index=web sourcetype=access_combined | regex _raw="(?i)(union\s+select|sleep\s*\(|benchmark\s*\(|into\s+outfile|information_schema)" | stats count by src_ip, uri_path
  • Drupal watchdog / database error log: Spike in PDOException or DatabaseExceptionWrapper errors on a single endpoint within a short window — Sigma shape: title: Drupal DB Exception Spike | logsource: product=drupal | detection: keywords: ['PDOException','DatabaseExceptionWrapper'] | timeframe: 5m | condition: count > 20
  • New privileged Drupal accounts (privilege escalation indicator): Monitor for INSERT events into users_field_data with status=1 followed by a role assignment of administrator in user__roles — especially outside business hours.
  • Unexpected outbound connections from the web server (post-exploitation): Zeek/Suricata network telemetry: outbound TCP from the Drupal host to unknown external IPs on ports 443/80/4444, particularly short-lived high-frequency connections indicative of reverse shells. Suricata: alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"Drupal Webserver Unexpected Outbound"; flow:established,to_server; sid:9999082;)
  • Sysmon EID 1 / auditd execve — RCE process chain: Process ancestry of php-fpm or apache2 spawning sh, bash, or python without an interactive TTY is a strong indicator of RCE following successful SQL injection exploitation.

Metrics

Severity
critical
Priority score
238.80
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
87.9 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-05-29 08:41 UTC
CWE
CWE-89

Weakness classes (CWE)

  • CWE-89Base

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-23 16:10 UTC· nvd@nist.gov
    • Translation: Title: Drupal core, Description: Neutralización Incorrecta de Elementos Especiales utilizados en un Comando SQL ('inyección SQL') vulnerabilidad en Drupal Drupal core permite inyección SQL. Este problema afecta a Drupal core: desde 8.9.0 antes de 10.4.10, desde 10.5.0 antes de 10.5.10, desde 10.6.0 antes de 10.6.9, desde 11.0.0 antes de 11.1.10, desde 11.2.0 antes de 11.2.12, desde 11.3.0 antes de 11.3.10.

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • bitnami

    drupal10.5.0

  • bitnami

    drupal10.6.0

  • bitnami

    drupal11.0.0

  • bitnami

    drupal11.2.0

  • bitnami

    drupal11.3.0

  • bitnami

    drupal8.9.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-9082