Drupal Core PostgreSQL SQL injection CVE-2026-9082 used in attacks; fixes available
Attackers are targeting Drupal websites using PostgreSQL. CVE-2026-9082 can expose data and sometimes allow server takeover without signing in. Website owners should ask their administrator to install the latest supported Drupal release urgently.
If you own a Drupal website, ask its administrator or hosting provider to install the latest supported Drupal release urgently and confirm whether it uses PostgreSQL. Sites on Drupal 8 or 9 should move to a supported release because the emergency manual patches leave other known vulnerabilities unresolved. Ordinary website visitors have no software update to install for this flaw.
What’s happening
CVE-2026-9082 affects Drupal, software used to build and run websites, when the site uses a PostgreSQL database. Someone without an account can interfere with database queries, potentially exposing information or gaining greater access; some configurations could allow code execution. Drupal released fixes on 20 May and confirmed attack attempts two days later, when CISA also listed the flaw as exploited. All affected branches supported at disclosure received fixed releases. Exceptional releases and manual patches for older branches do not resolve their other known vulnerabilities. Earlier Tenable and BleepingComputer reports quoted a 6.5 severity score; NVD now attributes a critical 9.8 score to Drupal. As at 3 November, the reviewed sources provide no public victim total or confirmation that attacks have ended.
- What
- Flaw
- Affects
- Drupal Core websites using PostgreSQL
- Affected
- PostgreSQL-backed Drupal core >=8.9.0 <10.4.10
PostgreSQL-backed Drupal core >=10.5.0 <10.5.10
PostgreSQL-backed Drupal core >=10.6.0 <10.6.9
PostgreSQL-backed Drupal core >=11.0.0 <11.1.10
PostgreSQL-backed Drupal core >=11.2.0 <11.2.12
PostgreSQL-backed Drupal core >=11.3.0 <11.3.10 - Fixed in
- Drupal core 10.4.10
Drupal core 10.5.10
Drupal core 10.6.9
Drupal core 11.1.10
Drupal core 11.2.12
Drupal core 11.3.10 - Since
- 18 May 2026
- Closed
- 22 May 2026
Timeline
- Vendor revised
Drupal confirmed that attack attempts were being detected and raised its risk score to 23 out of 25.
- CISA added
CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.
- New fixFixed
Drupal disclosed CVE-2026-9082 and released fixes in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10. The SQL injection affects PostgreSQL-backed sites; Drupal 8.9 and 9 received best-effort manual patches.
- UpdateNo fix yet
Drupal warned website administrators to prepare for an urgent security release on 20 May. It also announced exceptional fixes for some unsupported versions.
Sources
- Drupal core - Highly critical - SQL injection - SA-CORE-2026-004Drupal · 20 May 2026
- Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18Drupal · 18 May 2026
- Drupal security advisory (AV26-492) - Update 2Canadian Centre for Cyber Security · 22 May 2026
- CVE-2026-9082: Highly Critical SQL Injection Vulnerability in Drupal Core (SA-CORE-2026-004)Tenable · 21 May 2026
- Drupal: Critical SQL injection flaw now targeted in attacksBleepingComputer · 22 May 2026
- CVE-2026-9082 DetailNIST · 7 Oct 2026