Drupal · Core
The SQL injection flaw lies in the Core component of Drupal, the content management framework's core codebase, and affects releases from 8.9.0 up to (but not including) the fixed versions of 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10. The attack vector is network-based with low complexity, and it requires no privileges and no user interaction, so an unauthenticated remote attacker could potentially read, modify or destroy database data.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
First seen exploited 2 days after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in drupal/core over 7 weeks. The latest fix listed for drupal/core is 11.3.12.
unauthenticated network SQL injection on public-facing app
allows SQL Injection
SQL injection enables executing attacker-supplied database commands
Improper Neutralization of Special Elements used in an SQL Command
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: drupal/core.
Upgrade to 11.3.10 or later
Set the version to 11.3.10 or later in your composer.json.
The first fix for CVE-2026-9082.
| If you run | Upgrade to |
|---|---|
| 11.3.0 up to 11.3.10 | 11.3.10 |
| 11.2.0 up to 11.2.12 | 11.2.12 |
| 11.0.0 up to 11.1.10 | 11.1.10 |
| 10.6.0 up to 10.6.9 | 10.6.9 |
| 10.5.0 up to 10.5.10 | 10.5.10 |
| 8.9.0 up to 10.4.10 | 10.4.10 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.