Drupal has confirmed that a highly critical SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API is now under active attack. Disclosed on May 18, 2026, the flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against Drupal sites running on PostgreSQL, with potential for remote code execution, privilege escalation, and data exfiltration. On May 22, Drupal updated its advisory to reflect that exploitation attempts are being detected in the wild, elevating the urgency for administrators to patch immediately.

What Happened: Drupal Critical SQL Injection CVE-2026-9082 Under Active Attack

While the National Vulnerability Database (NVD) rates CVE-2026-9082 as medium severity (CVSS v3: 6.5), Drupal’s internal risk framework assigns it a score of 23 out of 25—its highest possible rating—reflecting the real-world danger of unauthenticated exploitation and the broad installed base of affected versions. The vulnerability was discovered by Google/Mandiant researcher Michael Maturi. All Drupal site administrators using PostgreSQL are urged to upgrade immediately.

Technical Details of the Drupal SQL Injection Flaw

CVE-2026-9082 resides in Drupal’s database abstraction API, a component designed to provide a unified interface for database operations across supported backends. The vulnerability allows specially crafted requests to inject malicious SQL commands directly into database queries. Unlike many SQL injection flaws that require authenticated access, this issue is exploitable without any credentials.

The attack vector is specific to PostgreSQL deployments. When Drupal processes certain database queries through its abstraction layer, insufficient sanitization of user-supplied input permits direct manipulation of SQL logic. Successful exploitation can lead to:

• Remote Code Execution (RCE): Attackers can leverage PostgreSQL features to execute arbitrary operating system commands on the underlying server.
• Privilege Escalation: Malicious actors can escalate from an unauthenticated position to full administrative control within the Drupal application.
• Information Disclosure: Sensitive data from the database—user credentials, configuration settings, and content—can be extracted.
• Data Modification/Deletion: Attackers can alter or destroy database contents.

The vulnerability is rated as low complexity to exploit, meaning threat actors do not require advanced techniques or resources to weaponize it. Because exploitation attempts have already been observed, defenders should assume mass scanning and automated exploitation are underway.

Business and Operational Impact of CVE-2026-9082

The impact of CVE-2026-9082 extends beyond individual websites to any organization relying on Drupal as a content management or application platform. Key consequences include:

• Website Compromise: Any unpatched Drupal site on PostgreSQL is at immediate risk of full takeover. With approximately 1.4 million websites globally running Drupal, the attack surface is substantial.
• Data Breach Risk: Compromised databases may expose personally identifiable information (PII), payment data, intellectual property, and proprietary business content.
• Service Disruption: Attackers can deface sites, inject malicious content, or render services unavailable, directly impacting revenue and reputation.
• Supply Chain Exposure: Organizations using Drupal as part of larger web application stacks may inadvertently expose downstream systems if compromised instances are used as pivot points.
• Compliance Implications: A successful breach involving PII may trigger breach notification requirements under GDPR, CCPA, HIPAA, and other regulatory frameworks.

Even sites not currently using PostgreSQL should apply updates promptly, as the latest security releases also address upstream dependency vulnerabilities in Symfony and Twig.

Drupal Patch and Mitigation Recommendations

Defenders should treat this vulnerability as an active and imminent threat. The following actions are recommended immediately:

1. Patch Immediately

Upgrade Drupal core to the latest available version for your branch. The following patched versions are available:

• Drupal 10.4.10 or later
• Drupal 10.5.10 or later
• Drupal 10.6.9 or later
• Drupal 11.1.10 or later
• Drupal 11.2.12 or later
• Drupal 11.3.10 or later

2. Audit End-of-Life Systems

Drupal 8.9.x, 9.x, and earlier versions are end-of-life. While patches are provided on a best-effort basis, these branches contain additional known vulnerabilities. Organizations should prioritize migration to supported branches.

3. Monitor for Indicators of Compromise

Review web server logs, database query logs, and Drupal audit trails for suspicious POST requests, unexpected SQL error patterns, or unauthorized administrative account creation. Pay special attention to unusual PostgreSQL process activity.

4. Implement Web Application Firewall (WAF) Rules

While patching is the definitive fix, WAF vendors and cloud security providers may release virtual patches or detection rules for CVE-2026-9082. Deploy these as a temporary compensating control if immediate patching is not feasible.

5. Validate Backups

Ensure clean, offline backups of both database and file systems are available and tested. In the event of compromise, rapid restoration is critical.

Bottom Line: With confirmed in-the-wild exploitation and a low barrier to entry for attackers, there is no justification for delay. Patch now, audit logs, and assume any unpatched PostgreSQL-backed Drupal site is already a target.

CVE-2026-9082 Incident Summary

References

1. BleepingComputer, “Drupal: Critical SQL injection flaw now targeted in attacks,” May 22, 2026, https://www.bleepingcomputer.com/news/security/drupal-critical-sql-injection-flaw-now-targeted-in-attacks/, accessed May 23, 2026.
2. Drupal Security Advisory, “Highly critical — SQL Injection in Database API,” May 18, 2026 (updated May 22, 2026), https://www.drupal.org/sa-core-2026-001, accessed May 23, 2026.
3. National Vulnerability Database, “CVE-2026-9082,” U.S. National Institute of Standards and Technology, https://nvd.nist.gov/vuln/detail/CVE-2026-9082, accessed May 23, 2026.
4. Censys, “Drupal Deployment Statistics and Exposure Analysis,” https://censys.io, accessed May 23, 2026.