CVE-2026-9082
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
View on NVDAnalysis
Esta vulnerabilidad crítica de inyección SQL en Drupal core permite a atacantes remotos escalar privilegios y ejecutar código arbitrario mediante peticiones maliciosas a la API de abstracción de base de datos. El fallo está siendo explotado activamente según reportes de CISA, afectando versiones desde la 8.9 hasta la 11.3 de Drupal.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCWE-89CISA KEV
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS
Affects
drupal:drupalTechnical description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.