Drupal core SQLi actively exploited (CVE-2026-9082) [PoC]

Actively exploited in the wild - CVE-2026-9082 is a medium SQL injection vulnerability in Drupal core versions 8.9.0 through 11.3.9 that lets unauthenticated attackers extract arbitrary database contents. Patches are available for all affected branches; update immediately.

Overview

CVE-2026-9082 is an improper neutralization of special elements used in an SQL command (SQL injection) vulnerability in Drupal core. The flaw allows an attacker with network access to inject malicious SQL queries without requiring authentication or user interaction. This means any public-facing Drupal site running an affected version is potentially compromised.

The vulnerability affects Drupal core from 8.9.0 through 10.4.9, 10.5.0 through 10.5.9, 10.6.0 through 10.6.8, 11.0.0 through 11.1.9, 11.2.0 through 11.2.11, and 11.3.0 through 11.3.9. It has been assigned a CVSS score of 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating low attack complexity and no required privileges.

Impact

An attacker exploiting CVE-2026-9082 can read sensitive data from the Drupal database, including user credentials, session tokens, configuration secrets, and content data. Given that the vulnerability is actively exploited in the wild (confirmed by CISA’s Known Exploited Vulnerabilities catalog), delays in patching directly expose your organization to data breaches. The EPSS score is very low (0.0%) for the next 30 days, but active exploitation campaigns are already underway.

Remediation

The Drupal security team has released patched versions for all affected branches. Upgrade immediately to one of the following versions:

• Drupal 10.4.10 or later
• Drupal 10.5.10 or later
• Drupal 10.6.9 or later
• Drupal 11.1.10 or later
• Drupal 11.2.12 or later
• Drupal 11.3.10 or later

If you cannot update immediately, apply any vendor-provided workarounds or disable database query access from untrusted networks as a temporary mitigation. Review your Drupal security advisories at security news for additional guidance.

Security Insight

This incident mirrors the 2022 Drupal SQL injection chain (CVE-2022-25298) that also targeted unauthenticated database access. The repeated exploitation pattern suggests that Drupal’s query preprocessing layer remains a weak point. The active exploitation of a medium-severity SQLi underscores that CVSS score alone is not a reliable triage filter; attackers prioritize operational simplicity over theoretical severity. Organizations running Drupal should treat unauthenticated database read access as a critical finding regardless of the CVSS base score, and implement Web Application Firewall (WAF) rules to block suspicious SQL patterns as a defense-in-depth measure. For updates on related data breaches, see breach reports.

Further Reading

• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs