Critical vulnerability CVE-2026-9082 affecting all supported Drupal versions is being actively exploited in the wild.
- CISA has added CVE-2026-9082, a critical SQL injection flaw in Drupal Core, to its Known Exploited Vulnerabilities catalog
- The vulnerability affects all supported versions of Drupal Core with a CVSS score of 6.5
- Evidence shows the flaw is being actively exploited by threat actors
The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Drupal Core vulnerability to its Known Exploited Vulnerabilities catalog following confirmation of active exploitation in the wild.
The vulnerability, tracked as CVE-2026-9082, is an SQL injection flaw that affects all supported versions of Drupal Core. CISA assigned the vulnerability a CVSS score of 6.5, classifying it as medium-to-high severity.
SQL injection vulnerabilities allow attackers to manipulate database queries by inserting malicious SQL code into application inputs. In the case of Drupal Core, this could potentially allow unauthorised access to sensitive data or administrative functions.
The addition to CISA’s KEV catalog indicates that federal agencies and critical infrastructure organisations are required to patch this vulnerability within established timeframes. CISA only adds vulnerabilities to the KEV when there is reliable evidence of active exploitation by threat actors.
Drupal is a widely-used content management system that powers millions of websites globally, including government agencies, educational institutions, and enterprise organisations. The broad scope of affected versions means a significant number of installations require immediate attention.
The vulnerability was recently patched by the Drupal Security Team, though specific details about the exploitation method and affected code have not been disclosed to prevent further abuse.
Why It Matters
This KEV addition signals that attackers are actively targeting Drupal installations across critical infrastructure. CISOs should prioritise patching efforts, particularly for public-facing Drupal sites that could serve as entry points for broader network compromise.
The SQL injection nature of this vulnerability presents significant data breach risk, potentially exposing customer records, administrative credentials, and other sensitive information stored in Drupal databases.
What To Do Now
- Immediately inventory all Drupal Core installations in your environment and verify current versions
- Apply the latest Drupal security patches as released by the Drupal Security Team
- Monitor web application logs for suspicious SQL injection attempts targeting Drupal sites
- Review CISA’s KEV catalog regularly for newly added vulnerabilities requiring urgent remediation
