Exploitation observed; activity peaked at 42 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-05-27. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-20 | 6 | General1Patch5 |
| 2026-05-21 | 42 | Active Exploitation6Disclosure14General3Patch16PoC3 |
| 2026-05-22 | 35 | Active Exploitation15Disclosure7General4Patch5PoC4 |
| 2026-05-23 | 25 | Active Exploitation18Disclosure3False Positive1General2Patch1 |
| 2026-05-24 | 9 | Active Exploitation5Disclosure1General1Patch1PoC1 |
| 2026-05-25 | 13 | Active Exploitation8Disclosure2General1Patch2 |
| 2026-05-26 | 17 | Active Exploitation11Disclosure2General1Patch2PoC1 |
| 2026-05-27 | 7 | Active Exploitation2Disclosure2General2Patch1 |
| 2026-05-28 | 4 | Disclosure1Exploit1Patch1PoC1 |
| 2026-05-30 | 1 | Patch1 |
| 2026-05-31 | 1 | Disclosure1 |
| 2026-06-01 | 4 | Active Exploitation3General1 |
| 2026-06-02 | 4 | Active Exploitation2Disclosure1Patch1 |
| 2026-06-03 | 5 | Active Exploitation1Disclosure2General1PoC1 |
| 2026-06-05 | 6 | Active Exploitation3Disclosure1Exploit1Patch1 |
| 2026-06-07 | 9 | Active Exploitation5Disclosure4 |
| 2026-06-08 | 2 | Active Exploitation1Patch1 |
| 2026-06-09 | 1 | General1 |
| 2026-06-10 | 1 | General1 |
| 2026-06-11 | 3 | Active Exploitation1Disclosure1General1 |
| 2026-06-14 | 2 | Active Exploitation2 |
| 2026-06-16 | 1 | General1 |
| 2026-06-17 | 2 | General1PoC1 |
| 2026-07-13 | 1 | General1 |
| 2026-07-23 | 1 | Active Exploitation1 |
| 2026-07-24 | 1 | General1 |
| 2026-08-15 | 1 | Active Exploitation1 |
| 2026-08-16 | 1 | Patch1 |
| 2026-08-17 | 2 | General1PoC1 |
| 2026-08-29 | 1 | General1 |
| 2026-09-11 | 1 | General1 |
CVE-2026-9082 Drupal core SQL injection https://www.drupal.org/sa-core-2026-004 https://t.co/DKlMy016cM
Post summary
The tweet references Drupal core CVE‑2026‑9082 as an SQL injection flaw and links to a Drupal security advisory that presumably contains a patch and mitigation steps; no active exploitation or exploit code is mentioned.
‼️🚨 Drupal CMS (which powers about 1 in 100 websites on the internet) has just released, not a 'critical' vuln patch, but a 'highly critical' patch to fix a SQL injection vuln. This vulnerability only affects sites using PostgreSQL. ID: CVE-2026-9082 https://t.co/0uXabu2jOw
Post summary
Drupal CMS has released a highly critical patch to address a SQL injection vulnerability (CVE-2026-9082) that affects PostgreSQL-powered sites.
We recently analyzed Drupal's security advisory (SA-CORE-2026-004 & CVE-2026-9082). This pre-auth SQLi only affects Drupal with Postgres as a db backend. Our research team at @SLCyberSec have published a writeup here: https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/
Post summary
The post discusses an analysis of Drupal’s CVE‑2026‑9082 – a pre‑authentication SQL injection limited to Postgres – and provides a link to a detailed write‑up, but it does not supply PoC code, exploits, active‑use reports, or patch information.
🔓 On an asset under our continuous monitoring, our pentester @nol_tech turned a SELECT-only PostgreSQL SQLi in Drupal (CVE-2026-9082) into a full RCE when DB role is superuser. Details below 👇 📝 https://blog.lexfo.fr/drupal-postgresql-sqli-to-rce.html 🛠️ https://github.com/ambionics/cve-2026-9082-drupal-postgresql-rce #Drupal #PostgreSQL #RCE #SQLi
Post summary
The tweet announces a pentester’s proof‑of‑concept that turns CVE‑2026‑9082 into a full RCE, with code shared via GitHub, but does not report any active exploitation or patch availability.
Our team at @SLCyberSec / @assetnote just shipped a same-day breakdown of CVE-2026-9082: critical anonymous SQLi in Drupal core, no auth needed. 👀 lots of bug bounty targets in scope. Technical details 👇 https://t.co/Y9fp5bOHD3
Post summary
The post announces a detailed breakdown of CVE-2026-9082, a critical anonymous SQL injection in Drupal core that requires no authentication, and provides a link for further technical details.
🚨 Drupal Core SQL injection is now actively exploited. https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html CISA added CVE-2026-9082 to its KEV catalog after exploitation was detected in the wild. Imperva observed: • 15,000+ attack attempts • Nearly 6,000 targeted sites • Activity across 65 countries • Gaming and financial services sites hit hardest, at nearly 50% of attacks The flaw affects all supported Drupal Core versions and could allow privilege escalation and remote code execution via specially crafted requests. Patch now: • Drupal 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, 10.4.10. • Drupal 9.5 and 8.9 require manual patching.
Post summary
The post reports that Drupal Core’s SQL injection flaw (CVE-2026-9082) is actively exploited worldwide, provides exploitation statistics, and offers patch information.
🛡️ We added Drupal core SQL injection vulnerability CVE-2026-9082 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/eRicxXzjb3
Post summary
The tweet announces that the Drupal core SQL injection vulnerability CVE-2026-9082 has been added to DHS’s KEV catalog, signifying it has been exploited in the wild, but offers no PoC, exploit code, or patch details.
Drupal CVE-2026-9082 boolean-blind extractor https://gist.github.com/dinosn/65a7da94cd93e0699f0549c70095eba2 , as per http://slcyber.io https://t.co/M9MXp2Yjn5
Post summary
The post reveals a proof‑of‑concept script for the Drupal CVE‑2026‑9082 Boolean blind vulnerability, linking to the code but providing no evidence of active exploitation or a patch.
Drupal CVE-2026-9082 Blind SQL Injection Checker 👾💉 🔗 https://github.com/N45HT/drupal-cve-2026-9082-checker 🔗 https://www.cve.org/CVERecord?id=CVE-2026-9082 🔗 https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/ https://t.co/LmkkKg4bpI
Post summary
The post announces a GitHub-based checker for Drupal CVE-2026-9082 Blind SQL Injection, providing a PoC but offering no patches, exploitation details, or confirmation of active attacks.
Masz Drupala? To łataj się jak najszybciej. ❌ Krytyczna podatność CVE-2026-9082 to SQL injection, który może być zrealizowany na ekranie logowania (czyli bez posiadania konta...) ❌ Działa to jeśli używasz bazy PostgreSQL ❌ Działa w standardowej konfiguracji Drupal 9 oraz 10, ale producent przygotował łatki dla w zasadzie wszystkich wersji (łącznie z tymi, które są już teoretycznie niewspierane - czyli 8.x oraz 9.x) ❌ Dostępny jest już exploit, więc warto się pospieszyć
Post summary
CVE‑2026‑9082 is a critical PostgreSQL‑based SQL injection in Drupal 9/10; an exploit exists and vendors have released patches for all supported versions.
Drupalで公開された重大SQLインジェクション脆弱性「CVE-2026-9082」が、修正公開直後から大規模に悪用され始めた。既に48時間で1万5000件超の攻撃が確認されている。 問題はPostgreSQLを利用するDrupal環境に影響する。データベースクエリを安全化するAPIに欠陥があり、攻撃者は細工したリクエストで任意SQLを実行できる。認証不要で悪用可能で、情報窃取、権限昇格、条件次第ではリモートコード実行にも発展する恐れがある。 Drupalは5月20日に修正版を公開し、数時間から数日以内に攻撃が始まる可能性を警告していた。実際、5月22日には「既に実環境で悪用試行を確認している」とアドバイザリを更新した。Drupal独自CVSSでは23点となり、最高25点中の極めて深刻な評価を受けている。 Impervaによれば、公開後2日間で約6000サイトを狙う1万5000件超の攻撃を観測した。標的は65カ国に及び、特にゲーム業界と金融業界が全体の約半数を占める。現在は脆弱サイト探索や検証段階が中心だが、今後はデータ窃取や権限奪取へ移行する可能性が高いという。 https://securityaffairs.com/192557/security/cve-2026-9082-drupals-highly-critical-sql-injection-flaw-is-already-under-active-attack.html
Post summary
CVE‑2026‑9082, a highly critical SQL injection in Drupal, was patched on May 20 but has already been widely exploited, with over 15,000 attacks detected worldwide in just 48 hours.
Keys to the Kingdom: Anonymous SQL Injection in Drupal Core (CVE-2026-9082) - Patrik Grobshäuser, Kevin Gervot, Tomais Williamson - @SLCyberSec https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/
Post summary
The post references a newly disclosed anonymous SQL injection in Drupal Core (CVE‑2026‑9082) with no details on exploits, patches, or active use.
GitHub - 7h30th3r0n3/CVE-2026-9082-Drupal-PoC: Drupal Core PostgreSQL SQL Injection PoC - CVE-2026-9082. Ethical PoC for the Drupal vulnerability allowing anonymous SQL injection through the JSON:API module on PostgreSQL-backed sites. · GitHub https://github.com/7h30th3r0n3/CVE-2026-9082-Drupal-PoC
Post summary
The GitHub repository provides an ethical Proof of Concept demonstrating anonymous SQL injection in Drupal via the JSON:API module on PostgreSQL sites.
⚠️ We are observing actors sending test exploits against the recent Drupal vulnerability CVE-2026-9082 since this morning Probes hit /jsonapi/node/* with a malformed filter[…][value][…] key, triggering the SQL injection bug to check whether the site is vulnerable. No data-extraction payloads yet, so this is likely recon ahead of the real wave. Monitor live attacks against Drupal 👉https://console.defusedcyber.com/intel
Post summary
The post reports early recon probing against Drupal CVE‑2026‑9082 via malformed JSONAPI filters that trigger an SQL injection, with no exploitation yet observed.
Rapid reaction gets you ahead. 2 days before CISA added CVE-2026-9082 a critical SQL Injection vulnerability in Drupal Core, to KEV, watchTowr clients were aware of their exposure. Reach out via our website if you need support. https://t.co/9yEKZfcyz2
Post summary
The tweet notes that watchTowr clients were aware of the Drupal Core SQL injection vulnerability before CISA added it to KEV, but provides no PoC, exploit, or patch details.
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（5/22追加） 🛡️No.1603 CVE-2026-9082 Drupal Core SQL Injection Vulnerability ================================== ✅概要 ・深刻度：緊急 9.8 (CVSS Base) / Drupal .org (CNA) ・種別：SQLインジェクション (CWE-89) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Drupal core のデータベース抽象化 API に存在する SQL インジェクションの脆弱性が存在します。PostgreSQL を使用しているサイトでは、細工されたリクエストにより任意の SQL インジェクションを実行される恐れがあります。 Drupal は、匿名ユーザーでも悪用可能であり、情報漏えいに加えて、場合によっては権限昇格、リモートコード実行、その他の攻撃につながる可能性があると説明。 ✅ChatGPTによる脆弱性評価 ・国内影響度：中 ・悪用難易度：低 ✅攻撃前提条件 ・影響を受ける Drupal core が稼働していること。 ・サイトが PostgreSQL データベースを使用していること。 ・攻撃者が対象サイトへネットワーク越しに到達可能であること。 ・認証は不要。 ✅悪用時影響 ・任意の SQL インジェクションを実行される ・情報漏えいにつながる ・場合によっては権限昇格、リモートコード実行、その他の攻撃につながる ✅悪用事例等に関する公開情報 ・PoC/Exploit：一部公開（技術情報のみ） ・ITW：確認済み。Drupal は 2026年5月22日に、悪用の試行が実環境で検知されていることを理由にリスクスコアを更新したと報告。 ✅関連情報 https://nvd.nist.gov/vuln/detail/CVE-2026-9082 https://www.drupal.org/sa-core-2026-004 https://www.tenable.com/blog/cve-2026-9082-highly-critical-sql-injection-vulnerability-in-drupal-core-sa-core-2026-004 https://github.com/ywh-jfellus/CVE-2026-9082 https://www.cisa.gov/news-events/alerts/2026/05/22/cisa-adds-one-known-exploited-vulnerability-catalog #vulnerability
Post summary
CISA has added CVE‑2026‑9082 to the KEV catalog after confirmed in‑the‑wild exploitation, with publicly available PoC code and a vendor patch already issued.
Drupal Vulnerability CVE-2026-9082 in Hacker Crosshairs Shortly After Disclosure https://www.securityweek.com/drupal-vulnerability-in-hacker-crosshairs-shortly-after-disclosure/
Post summary
The snippet only indicates a newly disclosed Drupal CVE without providing additional details on exploitation, patching, or technical characteristics.
👉 Vous utilisez le CMS Drupal pour votre site Web ? Patchez : il y a une belle injection SQL... ✍️ Plus d'infos par ici : https://www.it-connect.fr/drupal-cve-2026-9082-cette-faille-critique-de-type-injection-sql-menace-les-sites-web/ #CMS #Drupal https://www.it-connect.fr/drupal-cve-2026-9082-cette-faille-critique-de-type-injection-sql-menace-les-sites-web/
Post summary
The tweet highlights a new Drupal vulnerability (CVE‑2026‑9082) that introduces an SQL injection flaw and urges users to apply a patch.
🚨 A public-facing Drupal site backed by PostgreSQL should be treated as high risk right now. We reversed CVE-2026-9082 and released a Rapid Response test. https://t.co/FdcbAaBigV
Post summary
The mention focuses on a released Rapid Response test for CVE‑2026‑9082, indicating a proof‑of‑concept was provided, but no active exploitation or patch details are included.
CVE-2026-9082 Drupal Core PostgreSQL SQL Injection Overview and Takeaways https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-9082-drupal-core-postgresql-sql-injection-overview-and-takeaways/
Post summary
The excerpt points to a blog article discussing CVE‑2026‑9082 as a SQL injection flaw in Drupal Core’s PostgreSQL handling, but it does not provide PoC details, exploit code, active exploitation evidence, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | drupal | drupal | - | - | - |