Security readout for executives and security teams
Plain-English summary
This is a critical SQL injection vulnerability in Drupal core. An unauthenticated remote attacker may be able to affect confidentiality, integrity, and availability of a vulnerable Drupal site. CISA KEV status indicates exploitation has been observed. Public Drupal sites on affected versions should be treated as urgent remediation targets.
Executive priority
Treat this as an emergency patching issue for any public Drupal estate. The combination of critical severity, unauthenticated network reachability, and CISA KEV listing creates high business risk. Confirm ownership, patch status, and monitoring coverage quickly, then validate that no exposed Drupal core instance remains vulnerable.
Technical view
CVE-2026-9082 is CWE-89 in Drupal core with CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected ranges include Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10.
Likely exposure
Internet-facing Drupal core installations in the listed affected ranges are the primary concern. Exposure is especially likely where Drupal sites are public, unpatched, or hard to inventory. The provided sources do not identify a specific route, module, configuration, or hosting condition beyond Drupal core version exposure.
Exploitation context
CISA KEV status supports that this vulnerability is known exploited. The source bundle does not provide exploitation volume, indicators, payload details, or the vulnerable Drupal component. Treat affected public sites as potentially targeted while avoiding assumptions about specific attacker behavior not shown in the sources.
Researcher notes
The public bundle establishes product, affected ranges, CVSS, CWE, and KEV status, but not the vulnerable code path or exploit mechanics. Researchers should focus on safe version validation, asset discovery, advisory tracking, and evidence review. Do not infer affected contributed modules or mitigations not named by Drupal.
Mitigation direction
- Upgrade Drupal core to the fixed release for the deployed branch.
- Use Drupal SA-CORE-2026-004 as the authoritative remediation reference.
- Prioritize public and unauthenticated Drupal sites first.
- If immediate upgrade is impossible, reduce exposure and monitor vendor guidance.
- Review recent site, database, and authentication activity for anomalies.
Validation and detection
- Inventory all Drupal core versions across production, staging, and legacy sites.
- Confirm no instance runs within the affected version ranges.
- Verify patched sites report the expected fixed Drupal core version.
- Check CISA KEV status and internal vulnerability records for tracking.
- Review logs for unusual database errors or unexpected content changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-9082 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9drupalVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2026-9082 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-22T00:00:00.000Z: CVE-2026-9082 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://www.drupal.org/sa-core-2026-004CVE reference, drupal
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.