Is CVE-2026-9082 exploited in the wild?

Yes. CVE-2026-9082 is known to be exploited in the wild, first recorded on 22 May 2026. Treat it as urgent.

How severe is CVE-2026-9082?

Critical severity, with a CVSS score of 9.8, published 20 May 2026.

Which products and versions are affected?

Drupal >= 8.9.0, = 10.5.0, = 10.6.0, = 11.0.0, = 11.2.0, = 11.3.0, < 11.3.10, 8.9.0 to <10.4.10, 10.5.0 to <10.5.10, 10.6.0 to <10.6.9, 11.0.0 to <11.1.10, 11.2.0 to <11.2.12, 11.3.0 to <11.3.10; Drupal Core 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, 11.3.0 to < 11.3.10; drupal/core (Packagist) ECOSYSTEM:introduced=8.9.0,fixed=10.4.10, ECOSYSTEM:introduced=8.9.0,fixed=10.4.10|ECOSYSTEM:introduced=10.5.0,fixed=10.5.10|ECOSYSTEM:introduced=10.6.0,fixed=10.6.9|ECOSYSTEM:introduced=11.0.0,fixed=11.1.10|ECOSYSTEM:introduced=11.2.0,fixed=11.2.12|ECOSYSTEM:introduced=11.3.0,fixed=11.3.10.

Is there a fix for CVE-2026-9082?

Yes. drupal/core (Packagist): upgrade to 10.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9082 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9082?

Check whether you run Drupal Core, Drupal, Drupal Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction API

Q: Is there a fix for CVE-2026-9082?

Yes. drupal/core (Packagist): upgrade to 10.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-9082 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-9082?

Check whether you run Drupal Core, Drupal, Drupal Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9082 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-05-20

Drupal, a widely used content management system for building websites, contains a critical security flaw that could allow an attacker to interfere with the site's database. By exploiting this vulnerability, an unauthorized individual could potentially steal sensitive user data, modify website content, or gain full control over the site. Organizations using affected versions of Drupal should update to a patched version immediately to prevent potential data breaches or service disruptions.

Technologies: Drupal Core, Drupal, Drupal Core, drupal/core (Packagist). Vendors: Drupal, Packagist.

Quick answers

Is CVE-2026-9082 exploited in the wild?: Yes. CVE-2026-9082 is known to be exploited in the wild, first recorded on 22 May 2026. Treat it as urgent.
How severe is CVE-2026-9082?: Critical severity, with a CVSS score of 9.8, published 20 May 2026.
Which products and versions are affected?: Drupal >= 8.9.0, < 10.4.10; >= 10.5.0, < 10.5.10; >= 10.6.0, < 10.6.9; >= 11.0.0, < 11.1.10; >= 11.2.0, < 11.2.12; >= 11.3.0, < 11.3.10, 8.9.0 to <10.4.10, 10.5.0 to <10.5.10, 10.6.0 to <10.6.9, 11.0.0 to <11.1.10, 11.2.0 to <11.2.12, 11.3.0 to <11.3.10; Drupal Core 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, 11.3.0 to < 11.3.10; drupal/core (Packagist) ECOSYSTEM:introduced=8.9.0,fixed=10.4.10, ECOSYSTEM:introduced=8.9.0,fixed=10.4.10|ECOSYSTEM:introduced=10.5.0,fixed=10.5.10|ECOSYSTEM:introduced=10.6.0,fixed=10.6.9|ECOSYSTEM:introduced=11.0.0,fixed=11.1.10|ECOSYSTEM:introduced=11.2.0,fixed=11.2.12|ECOSYSTEM:introduced=11.3.0,fixed=11.3.10.
Is there a fix for CVE-2026-9082?: Yes. drupal/core (Packagist): upgrade to 10.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9082 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9082?: Check whether you run Drupal Core, Drupal, Drupal Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

drupal/core (Packagist): upgrade to 10.4.10 or later
```
composer require drupal/core:^10.4.10
```

Technical details

A SQL injection vulnerability (CWE-89) exists in Drupal core due to improper neutralization of special elements used in SQL commands. The vulnerability allows an unauthenticated remote attacker to send specially crafted input to the application that is then incorrectly handled during database query construction. This can lead to unauthorized data disclosure, modification, or deletion within the database. The issue affects multiple major versions of Drupal core, and patches have been released for the 10.4, 10.5, 10.6, 11.1, 11.2, and 11.3 branches.

Affected products

Drupal Drupal core >= 8.9.0, < 10.4.10; >= 10.5.0, < 10.5.10; >= 10.6.0, < 10.6.9; >= 11.0.0, < 11.1.10; >= 11.2.0, < 11.2.12; >= 11.3.0, < 11.3.10

Identifiers

CVE-2026-9082
DRUPAL-CORE-2026-004
GHSA-ghwc-95x2-682j

Timeline

2026-05-20: disclosed
2026-05-20: advisory
2026-06-18: patched: Advisory updated with reviewed status and final patch details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.