CVE-2026-9082: Drupal core SQL injection on PostgreSQL sites (SA-CORE-2026-004)

Exploited in the wild Critical 9.8 EPSS 89.4% Drupal core

A flaw in Drupal core's database abstraction API lets anonymous users send crafted requests that cause arbitrary SQL injection on sites using PostgreSQL, which can lead to data theft, privilege escalation or remote code execution. Only PostgreSQL-backed sites are open to the SQL injection, but the same releases also carry Symfony and Twig security updates that apply to every site. Drupal rated it Highly critical on 20 May 2026 and reported exploit attempts in the wild on 22 May; CISA added it to KEV the same day.

CVE-2026-9082CVE identifier
9.8CVSS 3.1 base score (critical)
2026-05-22added to CISA's exploited list (US federal deadline 2026-05-27)
89.4%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2026-05-20published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Drupal core and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
No service restart is needed.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

Drupal 8.9.0 before 10.4.10
Drupal 10.5.0 before 10.5.10
Drupal 10.6.0 before 10.6.9
Drupal 11.0.0 before 11.1.10
Drupal 11.2.0 before 11.2.12
Drupal 11.3.0 before 11.3.10

Fixed in:

Drupal 11.3.10
Drupal 11.2.12
Drupal 11.1.10
Drupal 10.6.9
Drupal 10.5.10
Drupal 10.4.10

Am I affected?

drush status --field=drupal-version
composer show drupal/core | grep versions
drush status --field=db-driver   # pgsql = exposed to the SQL injection

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

not packaged: composer update drupal/core-recommended

Ubuntu

not packaged: composer

RHEL, AlmaLinux, Rocky, Oracle

not packaged: composer

Fedora

not packaged: composer

SUSE / openSUSE

not packaged

Amazon Linux

not packaged: composer

Arch Linux

sudo pacman -Syu

Alpine

not packaged

FreeBSD

pkg update && pkg upgrade drupal11 (or drupal10)

Built from source

cd /path/to/drupal
composer update "drupal/core-*" --with-all-dependencies
drush updatedb -y
drush cache:rebuild
# Drupal 8.9 / 9.5 (end of life): apply the best-effort patch linked from SA-CORE-2026-004

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

Drupal lists no workaround. Sites on 11.1.x, 11.0.x, 10.4.x and older are end of life; the releases for them are best-effort, so plan an upgrade to a supported branch.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

https://www.drupal.org/sa-core-2026-004 ; https://nvd.nist.gov/vuln/detail/CVE-2026-9082

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.