CVE-2026-9082 — Vulnerability intelligence

Drupal — Core

Published: 2026-05-20T18:20:52.863Z

CVSS

9.8

CISA KEV

Known exploitation

Original source text (not a translation)

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Sources

• Drupal Core SQL Injection Vulnerability
• Original advisory
• Original advisory
• CVE-2026-9082