CVE-2026-9082: Drupal Core SQL Injection Vulnerability — Fixed versions

Summary

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Remediation

Inventory every Drupal Core deployment, including staging.
Upgrade Drupal Core to the fixed version for your release line, listed under Affected versions.
Confirm the running version after the upgrade.
Review logs from before the change for signs of exploitation.

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

Advisoryhttps://www.drupal.org/sa-core-2026-004
Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-9082
Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082

Version	Fixed in
8.9.0 – <10.4.10	10.4.10
10.5.0 – <10.5.10	10.5.10
10.6.0 – <10.6.9	10.6.9
11.0.0 – <11.1.10	11.1.10
11.2.0 – <11.2.12	11.2.12
11.3.0 – <11.3.10	11.3.10