Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 (CVE-2026-9082)

What is affected, what to do

The CVE-2026-9082 vulnerability is an SQL Injection flaw in Drupal Core, allowing privilege escalation and remote code execution via crafted requests to the database abstraction API. Attackers can exploit this to gain full control of the system, and it is actively exploited as evidenced by its listing in the CISA KEV catalog. This affects Drupal Core versions from 8.9.0 to 11.3.10. Immediate patching to the secure versions (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10) is imperative.

The vulnerability is being actively exploited; treat it as a priority. Update Drupal core to version 10.4.10, Drupal core to version 10.5.10, Drupal core to version 10.6.9. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Drupal core lt 8.9.0..10.4.10
• Drupal core lt 10.5.0..10.5.10
• Drupal core lt 10.6.0..10.6.9
• Drupal core lt 11.0.0..11.1.10
• Drupal core lt 11.2.0..11.2.12
• Drupal core lt 11.3.0..11.3.10

Fixed in

• Drupal core 10.4.10
• Drupal core 10.5.10
• Drupal core 10.6.9
• Drupal core 11.1.10
• Drupal core 11.2.12
• Drupal core 11.3.10

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory every Drupal instance (including staging, microsites and forgotten campaign sites): check the version with drush status --field=drupal-version or composer show drupal/core. Every release from 8.9.0 up to the fixed versions below is affected.
   • Apply the security update for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 or 11.3.10 (or later), e.g. composer update drupal/core-recommended --with-all-dependencies, then drush updatedb and drush cache:rebuild. Sites on 8.9.x through 10.3.x have no dedicated fix branch and must move to at least 10.4.10.
   • Internet-facing sites you cannot patch right now: put them into maintenance mode (drush state:set system.maintenance_mode 1) or restrict them behind a reverse-proxy allowlist until the update lands.
   • Check for compromise before returning to service: review users_field_data and user__roles for new accounts or accounts recently granted the administrator role, and sweep sites/default/files and module directories for new .php files.
   • If exploitation is suspected, rotate the database credentials in settings.php, the $settings['hash_salt'] and all admin passwords, and invalidate every session (truncate the sessions table). Take a forensic snapshot (webroot, DB dump, logs) before cleaning up.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF / reverse proxy: block requests whose parameter names or array keys contain SQL metacharacters (e.g. regex \[[^\]]*(['";]|--|/\*|\bunion\b|\bselect\b)[^\]]*\] against query string and POST body). Enable the OWASP CRS SQLi rule group 942xxx at paranoia level 2 or higher on Drupal hosts, in blocking rather than detection-only mode.
   • Network segmentation: make the database reachable only from the web tier; restrict web-server egress to required destinations (package repositories, mail relay) to break payload staging and reverse shells.
   • Database least privilege: strip FILE, SUPER and cross-schema access from the Drupal DB user; on PostgreSQL, no superuser role and no COPY ... PROGRAM. This limits the jump from SQL injection to code execution on the DB host.
   • Web-server hardening: deny PHP execution in sites/*/files, keep the webroot (except sites/*/files) read-only for the PHP process, and set disable_functions for exec, shell_exec, system, passthru, proc_open where no module depends on them.
   • Admin access: restrict /user/login and /admin/* to internal editorial networks via IP allowlist or VPN where operationally feasible.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: hunt for URL-encoded SQL fragments in parameter names, e.g. SPL: index=web host=drupal* (uri_query="*%5B*%27*" OR uri_query="*%5B*UNION*" OR uri_query="*%5B*SELECT*") | stats count by src_ip, uri_path. POST bodies are only visible in WAF/proxy logs — run the equivalent search there.
   • Drupal watchdog / DB error log: bursts of PDOException or SQLSTATE[42000] syntax errors in drush watchdog:show --type=php or the MySQL/MariaDB error log indicate injection attempts; alert on more than a handful per source IP per minute.
   • In-app privilege escalation: new user__roles rows with roles_target_id='administrator' or users created outside the editorial workflow; forward via a scheduled DB query or an audit module to the SIEM.
   • EDR process ancestry: php-fpm, apache2 or httpd spawning sh, bash, curl, wget, python or perl — Sigma shape: ParentImage|endswith: ['/php-fpm*','/apache2','/httpd'] AND Image|endswith: ['/sh','/bash','/curl','/wget']. auditd: -a always,exit -F arch=b64 -S execve -F uid=www-data -k web_exec.
   • File integrity: new or modified .php files under the webroot (auditd -w /var/www/ -p wa -k drupal_fim or Sysmon for Linux EID 11), especially in sites/default/files.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Source: CSA/SingCERT, pwn.watch, cvelistv5, NVD (NIST), OSV (Open Source Vulnerabilities), CISA KEV Catalog, ENISA EUVD, CVE.org (MITRE)

Vendors and products

• Drupal Drupal Core
• Drupal Drupal Core

Weakness classes (CWE)

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  Base

  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

  Entry at MITRE CWE-89

References & sources

• NVD (NIST)NVD: CVE-2026-9082advisory, pwn-watch
• github.comdrupal/corepackage
• drupal.orgDrupal Core — CVE-2026-9082web, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082government-resource
• cert.atCERT.at: Kritische Sicherheitslücke in Drupal Core - Updates verfügbarcert-at
• pwn.watchpwn.watch: Drupal Core: Drupal Core SQL Injection Vulnerabilitypwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 07.10.2026Record modifieddrupal.org

   New references:

   • https://www.drupal.org/sa-core-2026-004
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.drupal.org/sa-core-2026-004
   Reference	removed	https://www.drupal.org/sa-core-2026-004	—
   Reference type	removed	https://www.drupal.org/sa-core-2026-004 Types: Patch, Vendor Advisory	—

   Source identifier: mlhess@drupal.org

2. 07.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082
   Show 5 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082
   Reference	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082	—
   Reference type	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082 Types: US Government Resource	—
   SSVC assessment	removed	{"id":"CVE-2026-9082","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-05-20T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-9082","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-05-23T03:55:40.059743Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.

Linked advisories

• Drupal Critical SQL Injection Flaw ExploitedSANS NewsBites29.05.2026
• Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 21SANS @RISK28.05.2026