Skip to content
1.
CVE-2026-9082 (CVSS 9.8) lets unauthenticated attackers run arbitrary SQL against Drupal Core on PostgreSQL via crafted JSON:API queries, risking database compromise or RCE; upgrade immediately.
← back | CVE Intelligence
CVE-2026-9082 [Critical] [Actively exploited]
Curated 2 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-9082.
- CVSS
- 9.8
- Exploit Status
- Actively exploited
- Coverage Span
- 2026-05-22 → 2026-05-26
- Reports
- 2 related reports
Associated Reports & Timeline
2.
yeswehack.com | vulnerability | Critical | [Actively exploited] | | original ↗ | #active-exploitation | #sql-injection | #postgresql | #poc
A patch analysis of CVE-2026-9082 (SA-CORE-2026-004): a PostgreSQL-specific SQL injection in Drupal’s entity query subsystem where unsanitised array keys reach SQL, plus PoC paths and the fix.