Skip to main content
MEDIUM CISA KEV

CVE-2026-9082

CVSS v3

6.5

MEDIUM

EPSS Score

0.0 %

exploit probability

CISA KEV

Yes

known exploited

Exploitation

—

SSVC status

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

CISA Known Exploited Vulnerability

Date Added
2026-05-22
Patch Due Date
2026-05-27
Ransomware Use
Unknown

Technical details

Published
2026-05-20
Exploit-DB
EDB-52608

Frequently asked questions

What is CVE-2026-9082?

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Is CVE-2026-9082 actively exploited?

Yes. CVE-2026-9082 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2026-05-27.

What is the CVSS score for CVE-2026-9082?

CVE-2026-9082 has a CVSS v3 base score of 6.5 (MEDIUM severity).

Is CVE-2026-9082 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database