{"id":"drupal-core-sql-injection-may-2026","category":"patch","status":"closed","title":"Drupal Core PostgreSQL SQL injection CVE-2026-9082 used in attacks; fixes available","tldr":"Attackers are targeting Drupal websites using PostgreSQL. CVE-2026-9082 can expose data and sometimes allow server takeover without signing in. Website owners should ask their administrator to install the latest supported Drupal release urgently.","summary":"CVE-2026-9082 affects Drupal, software used to build and run websites, when the site uses a PostgreSQL database. Someone without an account can interfere with database queries, potentially exposing information or gaining greater access; some configurations could allow code execution. Drupal released fixes on 20 May and confirmed attack attempts two days later, when CISA also listed the flaw as exploited. All affected branches supported at disclosure received fixed releases. Exceptional releases and manual patches for older branches do not resolve their other known vulnerabilities. Earlier Tenable and BleepingComputer reports quoted a 6.5 severity score; NVD now attributes a critical 9.8 score to Drupal. As at 3 November, the reviewed sources provide no public victim total or confirmation that attacks have ended.","action":"If you own a Drupal website, ask its administrator or hosting provider to install the latest supported Drupal release urgently and confirm whether it uses PostgreSQL. Sites on Drupal 8 or 9 should move to a supported release because the emergency manual patches leave other known vulnerabilities unresolved. Ordinary website visitors have no software update to install for this flaw.","product":"Drupal Core websites using PostgreSQL","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-9082"],"tags":["drupal","postgresql","sql-injection","actively-exploited","website"],"affected":["PostgreSQL-backed Drupal core >=8.9.0 <10.4.10","PostgreSQL-backed Drupal core >=10.5.0 <10.5.10","PostgreSQL-backed Drupal core >=10.6.0 <10.6.9","PostgreSQL-backed Drupal core >=11.0.0 <11.1.10","PostgreSQL-backed Drupal core >=11.2.0 <11.2.12","PostgreSQL-backed Drupal core >=11.3.0 <11.3.10"],"fixed":["Drupal core 10.4.10","Drupal core 10.5.10","Drupal core 10.6.9","Drupal core 11.1.10","Drupal core 11.2.12","Drupal core 11.3.10"],"matches":[],"sources":[{"kind":"advisory","title":"Drupal core - Highly critical - SQL injection - SA-CORE-2026-004","url":"https://www.drupal.org/sa-core-2026-004","by":"Drupal","date":"2026-05-20"},{"kind":"advisory","title":"Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18","url":"https://www.drupal.org/psa-2026-05-18","by":"Drupal","date":"2026-05-18"},{"kind":"advisory","title":"Drupal security advisory (AV26-492) - Update 2","url":"https://www.cyber.gc.ca/en/alerts-advisories/drupal-security-advisory-av26-492","by":"Canadian Centre for Cyber Security","date":"2026-05-22"},{"kind":"research","title":"CVE-2026-9082: Highly Critical SQL Injection Vulnerability in Drupal Core (SA-CORE-2026-004)","url":"https://www.tenable.com/blog/cve-2026-9082-highly-critical-sql-injection-vulnerability-in-drupal-core-sa-core-2026-004","by":"Tenable","date":"2026-05-21"},{"kind":"news","title":"Drupal: Critical SQL injection flaw now targeted in attacks","url":"https://www.bleepingcomputer.com/news/security/drupal-critical-sql-injection-flaw-now-targeted-in-attacks/","by":"BleepingComputer","date":"2026-05-22"},{"kind":"advisory","title":"CVE-2026-9082 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-9082","by":"NIST","date":"2026-10-07"}],"started":"2026-05-18","closed":"2026-05-22","created":"2026-11-03T22:18:28.328Z","updated":"2026-11-03T22:18:28.328Z","cve_notes":[{"cve":"CVE-2026-9082","name":"SQL injection in Drupal Core's PostgreSQL database API","what":"A flaw in Drupal Core's database query handling lets an attacker without an account manipulate PostgreSQL queries, exposing data and potentially gaining greater access or running code.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-05-22T04:30Z","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Drupal confirmed that attack attempts were being detected and raised its risk score to 23 out of 25.","url":"https://www.drupal.org/sa-core-2026-004","by":"Drupal","patch":null},{"at":"2026-05-22","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/drupal-security-advisory-av26-492","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-05-20","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Drupal disclosed CVE-2026-9082 and released fixes in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10. The SQL injection affects PostgreSQL-backed sites; Drupal 8.9 and 9 received best-effort manual patches.","url":"https://www.drupal.org/sa-core-2026-004","by":"Drupal","patch":"patched"},{"at":"2026-05-18","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Drupal warned website administrators to prepare for an urgent security release on 20 May. It also announced exceptional fixes for some unsupported versions.","url":"https://www.drupal.org/psa-2026-05-18","by":"Drupal","patch":"none"}],"url":"https://hard.fyi/live/drupal-core-sql-injection-may-2026/","json":"https://hard.fyi/api/live?id=drupal-core-sql-injection-may-2026"}