CVE-2026-9082: Drupal’s PostgreSQL SQL injection is being probed — update your sites

A newly assigned vulnerability, CVE-2026-9082, affects Drupal’s core database abstraction layer in ways that enable arbitrary SQL injection on sites using PostgreSQL. The project’s advisory indicates the flaw can be exploited by anonymous users, with potential outcomes ranging from information disclosure to, in some cases, privilege escalation or remote code execution. Public reporting notes that exploitation attempts have already begun.

Why it matters

SQL injection flaws in a content management system can expose data and undermine site integrity. In this case, an unauthenticated attacker may be able to send crafted requests that reach the database layer on PostgreSQL-backed Drupal sites. The Drupal security team rated the issue “highly critical,” while the NVD entry currently reflects a CVSS v3 score of 6.5 (medium). Severity models differ, but the path forward is clear: update promptly.

What’s affected and what’s fixed

According to the advisory and public listings, the issue exists in Drupal core’s database API and only impacts sites running PostgreSQL. Patches are available. The following core releases are identified as containing the fix:

• 10.4.10
• 10.5.10
• 10.6.9
• 11.1.10
• 11.2.12
• 11.3.10

The advisory also notes that supported branches (11.3, 11.2, 10.6, 10.5) include coordinated security updates for Symfony and Twig. Those upstream updates can be relevant even for sites not using PostgreSQL, so updating remains advisable across the board.

Some older branches are end-of-life and do not normally receive security coverage. The advisory mentions additional releases or patches due to the severity of this issue; administrators should consult the official notice for specifics and availability.

Public reporting credits the discovery to Michael Maturi (Google/Mandiant) and indicates Drupal warned administrators to set aside time for the core updates. The advisory was subsequently updated to note that exploit attempts are being observed.

Practical steps now

If you maintain Drupal sites, a safe, priority order of action based on the available information is:

• Update Drupal core to a fixed release. For affected branches, that means 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10.
• Treat PostgreSQL-backed sites as urgent, since the SQL injection impact applies specifically to PostgreSQL.
• Apply the coordinated dependency updates (Symfony, Twig) included with the core releases. These may address additional issues depending on your configuration and contributed modules.
• Review which user roles can update Twig templates, as recommended in the advisory (e.g., via Views or contributed modules), and restrict that capability where appropriate.

Caveats and context

• Scope: The SQL injection described in CVE-2026-9082 affects Drupal sites using PostgreSQL. Sites on other database backends are not impacted by this specific flaw, though they still benefit from the bundled security updates.
• Timelines and breadth of exploitation: At the time of writing, the advisory and public reporting state that exploit attempts are being detected. The extent or success rate of those attempts is not detailed in the sources cited here.
• Packaging and availability: The advisory notes that release packaging may complete asynchronously; temporary 404s can occur while mirrors update. If a required package is briefly unavailable, retry shortly and confirm checksums when possible.
• Severity ratings: Drupal’s internal score and NVD’s CVSS differ. Administrators should weigh environmental risk, exposure, and the unauthenticated nature of the flaw when prioritizing updates.

References

• Drupal advisory: CVE-2026-9082 — SA-CORE-2026-004 (SQL injection, PostgreSQL only): https://www.drupal.org/sa-core-2026-004
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-9082
• Reporting on active exploit attempts: BleepingComputer news coverage: https://www.bleepingcomputer.com/news/security/drupal-critical-sql-injection-flaw-now-targeted-in-attacks/

Keeping core and dependencies current remains the most reliable defense. Given the unauthenticated nature of this issue and the reported probing activity, Drupal administrators should prioritize updates and limit risky template-editing privileges while reviewing the official guidance.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.