The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-9082, a highly critical SQL injection vulnerability in Drupal Core, to its Known Exploited Vulnerabilities (KEV) catalog on May 22, 2026.
CVE-2026-9082 stems from a breakdown of input sanitization within Drupal’s PostgreSQL EntityQuery condition handler (pgsql/src/EntityQuery/Condition.php), specifically when processing array structures passed via HTTP requests.
Drupal SQL Injection Flaw
PHP’s query string parser allows attackers to control array keys, not just values, which are then preserved through pipelines like JSON: API and Views, ultimately delivering unsanitized SQL directly to the PostgreSQL backend, said Drupal.
Drupal’s official security advisory SA-CORE-2026-004 rated this flaw as “highly critical” with an internal severity score of 23 out of 25.
The vulnerability was disclosed on May 19, 2026, and exploitation began within less than 48 hours of patch release.
Researchers recorded over 15,000 attack attempts targeting approximately 6,000 individual sites across 65 countries, signaling widespread and opportunistic exploitation campaigns.
The flaw is particularly dangerous because it can be exploited by anonymous, unauthenticated users, meaning any publicly exposed Drupal site running PostgreSQL is immediately at risk, with no credential requirement, Cisa said.
Affected Versions and Fixed Releases
Drupal has issued patches across all supported branches, as well as exceptional releases for two end-of-life versions, given the severity:
| Affected Version | Fixed Version |
|---|---|
| Drupal 11.3.0 – 11.3.9 | 11.3.10 |
| Drupal 11.2.0 – 11.2.11 | 11.2.12 |
| Drupal 11.0.0 – 11.1.9 | 11.1.10 (EOL – exceptional release) |
| Drupal 10.6.0 – 10.6.8 | 10.6.9 |
| Drupal 10.5.0 – 10.5.9 | 10.5.10 |
| Drupal 10.4.x and earlier | 10.4.10 |
| Drupal 9.5 / 8.9 | Manual hotfix patch required |
| Drupal 7 | Not affected |
Sites running MySQL, MariaDB, or SQLite databases are not affected by this vulnerability.
Mitigation
Federal Civilian Executive Branch (FCEB) agencies must remediate under BOD 22-01 by May 27, 2026. According to CISA, all organizations should take the following immediate steps:
- Update Drupal Core to the patched version corresponding to your branch
- Verify your database backend sites using MySQL/MariaDB/SQLite are not affected
- Apply manual hotfix patches if running end-of-life Drupal 8.9 or 9.5 branches
- Deploy WAF rules targeting JSON:API and Views request patterns to block malicious array-key manipulation attempts
Drupal powers millions of websites globally, including government portals and enterprise content platforms, making any Core-level flaw a high-value target for threat actors.
While the ransomware association remains unknown at this stage, SQL injection flaws that enable unauthenticated RCE are frequently used as initial access vectors in campaigns that lead to data exfiltration, backdoor installation, and lateral movement across the infrastructure.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 has added CVE-2026-9082, a highly critical SQL injection vulnerability in Drupal Core, to its Known Exploited Vulnerabilities (KEV) catalog on May 22, 2026 just days after active exploitation was detected across thousands of sites worldwide.){kind=link}