Snapshot of public data from 30 Oct 2026, 10:41:14. This data is not updated until the API is deployed.

CVE-2026-9082

Drupal Core SQL Injection Vulnerability

UrgentCVSS 9.8 v3.1Exploited

Why this priority

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Affected products

Vendor	Product	Versions
Drupal	Drupal core	from 8.9.0 to 10.4.10 excluded from 10.5.0 to 10.5.10 excluded from 10.6.0 to 10.6.9 excluded from 11.0.0 to 11.1.10 excluded from 11.2.0 to 11.2.12 excluded from 11.3.0 to 11.3.10 excluded
Drupal	Core	All versions

Revision history

Revision 2 30 Oct 2026, 10:18:44
Update : Affected versions changed
Revision 1 30 Oct 2026, 10:17:21
New record

Qualification

CVSS severity ? Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary: 9.8 CRITICAL CVSS v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KEV catalog ? CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary: Listed
Exploitation: Confirmed
EPSS probability ? Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary: Unknown
Confidence ? Quality of the sources behind the record. It is not a risk score. See the glossary: High

Priority rules, version 1

CISA KEV catalog

Added on: 22 May 2026
Federal due date: 27 May 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware use: Unknown