CVE-2026-9082
Description
CVE-2026-9082 is a critical SQL injection vulnerability in Drupal Core (CVSS 9.8) that is actively exploited. Patch affected versions immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| drupal | 8.9.0 | 10.4.10 | vulnerable |
| drupal | 10.5.0 | 10.5.10 | vulnerable |
| drupal | 10.6.0 | 10.6.9 | vulnerable |
| drupal | 11.0.0 | 11.1.10 | vulnerable |
| drupal | 11.2.0 | 11.2.12 | vulnerable |
| drupal | 11.3.0 | 11.3.10 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately apply the security updates released by the Drupal security team. Depending on your current branch, update to Drupal Core 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10.
Update affected systems
Verify all Drupal installations and upgrade any versions within the affected ranges, specifically those between 8.9.0 and 10.4.9, or the various 10.x and 11.x sub-versions identified as vulnerable.
Restrict access
Deploy or update a Web Application Firewall (WAF) with specific SQL injection (SQLi) protection rules to filter malicious traffic. If possible, restrict access to administrative interfaces to known IP addresses.
Monitor for exploitation
Audit database logs for unauthorized queries and inspect web server access logs for common SQLi patterns such as 'UNION SELECT' or 'OR 1=1' within URL parameters and POST requests.
Detection Guidance
To detect CVE-2026-9082, monitor web server logs for suspicious URL parameters or POST bodies containing SQL syntax like 'SELECT', 'UNION', or 'SLEEP()'. Utilize WAF signatures specifically designed for Drupal core vulnerabilities. Additionally, audit database logs for unauthorized administrative account creation or unexpected data exports. Organizations should also scan for the presence of web shells that may have been dropped following a successful injection attack.