CVE-2026-9082
Last modified
CVE-2026-9082 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.. CISA has confirmed active exploitation in the wild. EPSS estimates a 84.63% chance of exploitation in the next 30 days.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal | >= 8.9.0, < 10.4.10 |
| Drupal | Drupal | >= 10.5.0, < 10.5.10 |
| Drupal | Drupal | >= 10.6.0, < 10.6.9 |
| Drupal | Drupal | >= 11.0.0, < 11.1.10 |
| Drupal | Drupal | >= 11.2.0, < 11.2.12 |
| Drupal | Drupal | >= 11.3.0, < 11.3.10 |
References
- https://www.drupal.org/sa-core-2026-004Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-9082?
How severe is CVE-2026-9082?
How do I fix CVE-2026-9082?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9076Issue summary: When CMS password-based decryption (RFC 3211 …7.5
- CVE-2026-9077IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote…8.5
- CVE-2026-9078Firefox for iOS displayed specially crafted right-to-left (R…5.4
- CVE-2026-9079libcurl had a flaw that when instructed to clear proxy authe…9.8
- CVE-2026-9080Calling `curl_easy_pause()` within the event-based `CURLMOPT…7.3
- CVE-2026-9081IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.1…7.1
- CVE-2026-9083A flaw was found in Keycloak. A realm administrator with the…4.9
- CVE-2026-9084MISP’s OIDC authentication plugin allowed automatic linking …6
- CVE-2026-9085Incorrect Permission Assignment for Critical Resource, Impro…8.8
- CVE-2026-9086A flaw was found in Keycloak. A remote attacker with adminis…7.3
- CVE-2026-9087A flaw was found in Keycloak. The cross-session verification…8.1
- CVE-2026-9088A flaw was found in org.keycloak.services. An administrator …2.7
Are you affected by CVE-2026-9082?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST