SQL injection in Drupal Core (CVE-2026-9082) — risk of privilege escalation and remote code execution
Drupal, a widely used open-source CMS, has a SQL injection vulnerability in its core via the database abstraction API; specially crafted requests can lead to privilege escalation and remote code execution (RCE). CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical).
Key facts
- CVE IDCVE-2026-9082
- CVSS base score9.8 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Affected (vendor / product)Drupal Core
- CWECWE-89
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-05-27 (U.S. federal civilian agencies, BOD 22-01)
Key points
- SQL injection (CWE-89) in Drupal Core via the database abstraction API
- Can lead to privilege escalation and remote code execution (RCE)
- A flaw in CMS core functionality = widely deployed, broad blast radius
- Listed in CISA KEV = exploitation confirmed (CVSS 9.8 Critical)
- Response: update core per Drupal's instructions. Public websites are high priority
- Sitting in the database abstraction API, a core function, it can affect anyone running Drupal at all.
1The Drupal Core flaw
CVE-2026-9082 is a SQL injection vulnerability (CWE-89) in Drupal Core (the heart of the open-source CMS Drupal, used by many public-sector and enterprise sites). It was added to CISA's KEV catalog on May 22, 2026.
2A problem in the database abstraction API
Per NVD, sending specially crafted requests through Drupal's database abstraction API (the layer that standardizes database access) achieves SQL injection that can lead to privilege escalation and remote code execution (RCE). Because it is a flaw in core functionality (the foundation shared by many sites), the blast radius is broad.
3How widely government and university sites use it
Drupal is widely adopted by government agencies, universities, and enterprises. If this is exploited on an internet-facing site, it can lead to site defacement or takeover and code execution on the server. A CMS is an easily reachable "internet-exposed asset" for attackers, so the KEV listing pushes for prompt updates.
4A module vulnerability, and a core vulnerability
For a CMS, whether a vulnerability sits in an added feature or in the core changes its reach. This record is the latter.
The subject is the database abstraction API, the mechanism unifying access to the database. Sending a crafted request achieves SQL injection, which can lead to privilege escalation and remote code execution. Drupal is widely adopted for government, university and corporate websites, and exploitation on a publicly exposed site leads to defacement, takeover, or code execution on the server.
Why it matters
A core SQLi/RCE in a widely used CMS, directly tied to defacement/takeover risk for public websites. Organizations running Drupal should update core immediately, inventory exposed assets, and review web-server logs.
FAQ
What is Drupal?
How dangerous is it?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).