# CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction API

Source: https://junglewise.ai/threats/cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-9082 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-05-20

Drupal, a widely used content management system for building websites, contains a critical security flaw that could allow an attacker to interfere with the site's database. By exploiting this vulnerability, an unauthorized individual could potentially steal sensitive user data, modify website content, or gain full control over the site. Organizations using affected versions of Drupal should update to a patched version immediately to prevent potential data breaches or service disruptions.

Technologies: [Drupal Core](https://junglewise.ai/threats/technologies/core), [Drupal](https://junglewise.ai/threats/technologies/drupal), [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-9082 exploited in the wild?** Yes. CVE-2026-9082 is known to be exploited in the wild, first recorded on 22 May 2026. Treat it as urgent.

**How severe is CVE-2026-9082?** Critical severity, with a CVSS score of 9.8, published 20 May 2026.

**Which products and versions are affected?** Drupal >= 8.9.0, < 10.4.10; >= 10.5.0, < 10.5.10; >= 10.6.0, < 10.6.9; >= 11.0.0, < 11.1.10; >= 11.2.0, < 11.2.12; >= 11.3.0, < 11.3.10, 8.9.0 to <10.4.10, 10.5.0 to <10.5.10, 10.6.0 to <10.6.9, 11.0.0 to <11.1.10, 11.2.0 to <11.2.12, 11.3.0 to <11.3.10; Drupal Core 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, 11.3.0 to < 11.3.10; drupal/core (Packagist) ECOSYSTEM:introduced=8.9.0,fixed=10.4.10, ECOSYSTEM:introduced=8.9.0,fixed=10.4.10|ECOSYSTEM:introduced=10.5.0,fixed=10.5.10|ECOSYSTEM:introduced=10.6.0,fixed=10.6.9|ECOSYSTEM:introduced=11.0.0,fixed=11.1.10|ECOSYSTEM:introduced=11.2.0,fixed=11.2.12|ECOSYSTEM:introduced=11.3.0,fixed=11.3.10.

**Is there a fix for CVE-2026-9082?** Yes. drupal/core (Packagist): upgrade to 10.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9082 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9082?** Check whether you run Drupal Core, Drupal, Drupal Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 10.4.10 or later

  ```sh
  composer require drupal/core:^10.4.10
  ```


## Technical details

A SQL injection vulnerability (CWE-89) exists in Drupal core due to improper neutralization of special elements used in SQL commands. The vulnerability allows an unauthenticated remote attacker to send specially crafted input to the application that is then incorrectly handled during database query construction. This can lead to unauthorized data disclosure, modification, or deletion within the database. The issue affects multiple major versions of Drupal core, and patches have been released for the 10.4, 10.5, 10.6, 11.1, 11.2, and 11.3 branches.

## Affected products

- Drupal Drupal core >= 8.9.0, < 10.4.10; >= 10.5.0, < 10.5.10; >= 10.6.0, < 10.6.9; >= 11.0.0, < 11.1.10; >= 11.2.0, < 11.2.12; >= 11.3.0, < 11.3.10

## Identifiers

- CVE-2026-9082
- DRUPAL-CORE-2026-004
- GHSA-ghwc-95x2-682j

## Timeline

- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-06-18: patched: Advisory updated with reviewed status and final patch details.

## References

- [https://api.github.com/users/Rudloff](https://api.github.com/users/Rudloff)
- [https://github.com/Rudloff](https://github.com/Rudloff)
- [https://api.github.com/users/Rudloff/gists%7B/gist_id%7D](https://api.github.com/users/Rudloff/gists%7B/gist_id%7D)
- [https://api.github.com/users/Rudloff/repos](https://api.github.com/users/Rudloff/repos)
- [https://avatars.githubusercontent.com/u/840125?v=4](https://avatars.githubusercontent.com/u/840125?v=4)
- [https://api.github.com/users/Rudloff/events%7B/privacy%7D](https://api.github.com/users/Rudloff/events%7B/privacy%7D)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal Core remote code execution in Field UI module](https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)