The Drupal team has released security updates that address the CVE-2026-9082 vulnerability in the CMS core. The flaw allows unauthenticated users to execute arbitrary SQL queries on sites that use PostgreSQL databases, which can lead to data leakage, privilege escalation, or remote code execution. Drupal 10 and 11 branches are affected — administrators are strongly advised to immediately install the fixed versions.

Technical details of the vulnerability

According to the official Drupal security advisory, the vulnerability resides in the database abstraction API, which is responsible for query validation and protection against SQL injection. The irony is that the very component designed to prevent SQL injection turned out to be vulnerable to it.

An attacker can send specially crafted requests that bypass the sanitization mechanism and result in arbitrary SQL injection. Key characteristics of the vulnerability:

• CVE ID: CVE-2026-9082
• CVSS score: 6.5 out of 10.0
• Attack vector: remote, unauthenticated
• Scope of impact: only sites using PostgreSQL
• Consequences: information disclosure, privilege escalation, remote code execution

It is worth noting the discrepancy in severity ratings: Drupal classifies the vulnerability as “highly critical”, whereas a CVSS 6.5 score on the standard v3.x scale corresponds to a medium severity level. Drupal uses its own risk classification system that takes into account the specifics of the CMS ecosystem, in particular the possibility of exploitation by anonymous users, which significantly increases the practical risk for public websites.

Affected versions and available updates

Fixes have been released for the following versions:

• Drupal 11.3.10
• Drupal 11.2.12
• Drupal 11.1.10
• Drupal 10.6.9
• Drupal 10.5.10
• Drupal 10.4.10

Drupal 7 is not affected by this vulnerability. Releases for the supported branches (11.3, 11.2, 10.6, and 10.5) additionally include security updates for Symfony and Twig, which makes installing the latest versions even more important.

For versions that have reached end of life — Drupal 9.5 and Drupal 8.9 — manual patches have been provided. However, Drupal emphasizes that these patches are supplied on a “best-effort” basis and do not guarantee full protection: unsupported versions contain other previously disclosed vulnerabilities.

The Drupal 11.1.x, 11.0.x, 10.4.x branches and below have also reached end of life and no longer receive regular security coverage.

Impact assessment

Although the vulnerability affects only sites running on PostgreSQL, which narrows the blast radius compared to MySQL/MariaDB (more common in the Drupal ecosystem), the risk remains significant for several reasons:

• No authentication required — the attack can be carried out by any site visitor, making exploitation trivial once a working exploit is available
• Wide range of consequences — from reading database contents to full system takeover via remote code execution
• PostgreSQL in the enterprise segment — this DBMS is more commonly used in large and enterprise Drupal deployments, where the potential damage from compromise is higher

At the time of publication, there is no information about active exploitation of the vulnerability in real-world attacks, and CVE-2026-9082 has not been added to the CISA KEV catalog. Nevertheless, SQL injection flaws in popular CMSs have historically attracted attacker attention in the shortest possible time after technical details are published.

Recommendations

1. Immediately update Drupal to the fixed version that matches your branch. For supported branches (11.3, 11.2, 10.6, 10.5), this is the top priority action
2. Determine which DBMS you use — if the site runs on MySQL or MariaDB, the vulnerability is not applicable, but updating is still recommended due to the included Symfony and Twig patches
3. For legacy versions (Drupal 8.9, 9.5) — apply the manual patches as a temporary measure and plan a migration to a supported branch
4. Review web server logs for anomalous requests to the database API, especially those containing atypical SQL constructs for PostgreSQL
5. Use a WAF with SQL injection detection rules as an additional protection layer during the update window

Administrators of Drupal sites using PostgreSQL should treat this update as urgent and apply it within the next 24–48 hours. The combination of anonymous exploitation and the potential for remote code execution makes CVE-2026-9082 an attractive target for automated attacks — delaying patching significantly increases the likelihood of compromise.