Urgent Warning: Critical SQL Injection Vulnerability Under Attack

Drupal administrators are being cautioned about the dangers posed by hackers attempting to exploit a severe SQL injection vulnerability that was recently disclosed. The content management system (CMS) project issued a Public Service Announcement (PSA) on May 18, advising administrators to promptly update their systems to address the vulnerability before threat actors can take advantage of it.

The vulnerability, now identified as CVE-2026-9082 and uncovered by Google/Mandiant researcher Michael Maturi, affects Drupal’s database abstraction API. It allows malicious requests to trigger SQL injection attacks on websites using PostgreSQL, potentially leading to unauthorized access, data modification, or deletion.

SQL injection is a critical security flaw that enables attackers to inject malicious SQL commands into user input fields on websites, leading to various forms of database compromise. The exploit is particularly concerning as it can be carried out without authentication, potentially resulting in remote code execution, privilege escalation, and sensitive information disclosure.

In a recent update to the advisory on May 22, Drupal confirmed that incidents of exploitation attempts have been detected in the wild, prompting an increased risk score for the vulnerability. Drupal has classified the issue as “highly critical,” with an internal severity rating of 23 out of 25. However, the National Institute of Standards and Technology (NIST) has assigned it a “medium severity” rating based on a CVSS v3 score of 6.5.

Impact and Recommendations

The SQL injection vulnerability (CVE-2026-9082) affects a wide range of Drupal versions, including Drupal 8.9.x, Drupal 10.4.x to 10.6.x, and Drupal 11.0.x to 11.3.x. Website owners and administrators are strongly advised to upgrade to the latest available version for their specific branch to mitigate the risk of exploitation.

Even for those not using PostgreSQL, updating to the latest Drupal version is recommended, as it includes essential security patches for upstream dependencies like Symfony and Twig. The advisory also highlights that Drupal 8 and 9 have reached their end-of-life (EoL) status, with patches provided on a “best-effort” basis. Continuing to use these older branches poses inherent security risks due to the presence of other known vulnerabilities.