{"identifier":"CVE-2026-9082","cve":{"id":"CVE-2026-9082","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.\n\nThis issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.","published":"2026-05-20T20:16:41.230000+00:00","modified":"2026-10-07T19:17:45.637000+00:00","status":"Analyzed","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"8.9.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"10.4.10"},{"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"10.5.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"10.5.10"},{"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"10.6.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"10.6.9"},{"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"11.1.10"},{"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"11.2.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"11.2.12"},{"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"11.3.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"11.3.10"}],"weaknesses":["CWE-89"],"references":[{"url":"https://www.drupal.org/sa-core-2026-004","source":"mlhess@drupal.org","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}],"kev":{"cveID":"CVE-2026-9082","vendorProject":"Drupal","product":"Core","vulnerabilityName":"Drupal Core SQL Injection Vulnerability","dateAdded":"2026-05-22","shortDescription":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2026-05-27","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"https://www.drupal.org/sa-core-2026-004 ; https://nvd.nist.gov/vuln/detail/CVE-2026-9082","cwes":["CWE-89"]},"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"mlhess@drupal.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-23T03:55:40.059743Z","id":"CVE-2026-9082","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"8.9.0","versionEndExcluding":"10.4.10","matchCriteriaId":"D913070F-48D6-4282-8F54-72F40C57EFE9"},{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"10.5.0","versionEndExcluding":"10.5.10","matchCriteriaId":"358B0EE2-C620-4B3C-ACF3-A0537BF3DCD9"},{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"10.6.0","versionEndExcluding":"10.6.9","matchCriteriaId":"27F0A477-45CF-4670-A40B-C45EF45DDFD8"},{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"11.1.10","matchCriteriaId":"2CA9EE15-B47E-416A-9486-8A3CA815EF22"},{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"11.2.0","versionEndExcluding":"11.2.12","matchCriteriaId":"F34F68CB-E0D0-4F30-9B8C-7A51BF285F26"},{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"11.3.0","versionEndExcluding":"11.3.10","matchCriteriaId":"C878524F-B5D0-4894-81BD-6E17AFB30A4A"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T16:14:21.169061+00:00","exploited":true,"kev_stale":false,"products":["drupal / drupal"],"priority":{"label":"Known exploitation: prioritize review","reasons":["CISA KEV lists real-world exploitation."]},"epss":{"probability":0.89381,"percentile":0.99782,"date":"2026-10-27","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"www.drupal.org","source_url":"https://www.drupal.org/sa-core-2026-004","investigate_url":"https://investigate.aeglixmind.com/#www.drupal.org"},{"domain":"www.cisa.gov","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082","investigate_url":"https://investigate.aeglixmind.com/#www.cisa.gov"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-9082","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-9082","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-9082","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}