Cyber Resilience

CVE-2026-9082

CriticalCISA KEVActive Exploitation

Published: 20 May 2026

Published
20 May 2026
Modified
22 May 2026
KEV Added
22 May 2026
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.8463 99.7th percentile
Risk Priority 100 floored blend · peak EPSS

Summary

CVE-2026-9082 is a critical-severity SQL Injection (CWE-89) vulnerability in Drupal Drupal. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-9082 is an SQL injection vulnerability arising from improper neutralization of special elements in SQL commands, present in Drupal core. It affects versions from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, and from 11.3.0 before 11.3.10.

An unauthenticated remote attacker can supply crafted input over the network to execute arbitrary SQL commands against the database, potentially achieving full confidentiality, integrity, and availability impact on the affected Drupal installation.

The referenced Drupal security advisory SA-CORE-2026-004 and CISA Known Exploited Vulnerabilities catalog entry direct administrators to apply the listed patches that remediate the flaw in each affected branch.

The EPSS score rose from a low baseline after disclosure to a peak of 0.3465 on 2026-05-31 before receding to the current value of 0.1040, and the vulnerability's presence in the CISA KEV catalog indicates confirmed real-world exploitation activity.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before…

more

11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

CWE(s)
CWE-89
KEV Date Added
22 May 2026

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct SQL injection in public-facing Drupal web application maps to exploitation of public-facing apps.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-31674Same product: Drupal Drupal
CVE-2026-21630Same product class: CMS core
CVE-2026-35222Same product class: CMS core
CVE-2026-35221Same product class: CMS core
CVE-2024-8855Same product class: CMS core
CVE-2025-54236Same product class: CMS coreboth on KEV
CVE-2026-21643Shared CWE-89both on KEV
CVE-2025-31692Same product class: CMS core
CVE-2025-1970Same product class: CMS core
CVE-2026-21309Same product class: CMS core

Affected Assets

drupal
drupal
8.9.0 — 10.4.10 · 10.5.0 — 10.5.10 · 10.6.0 — 10.6.9

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and neutralization of untrusted input to block crafted SQL elements before they reach the database.

SI-2 Flaw Remediation good match
prevent

Mandates prompt application of the vendor patches listed in SA-CORE-2026-004 to eliminate the SQL injection flaw in all affected Drupal branches.

AC-3 Access Enforcement partial match
prevent

Enforces access-control decisions on database queries, limiting the ability of unauthenticated input to execute arbitrary SQL even if neutralization fails.

References