Read the docs
TI-2026-07979 Aliases CVE-2026-9082GHSA-ghwc-95x2-682j

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Priority CRITICAL 100Exploited in the wildCWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Why it matters now

Exploitation Active In CISA KEV since 2026-05-22CISA due date 2026-05-27
EPSS 0.89381 99th percentileScored 2026-11-07
Fix Fixed Drupal core (Drupal): 10.4.10, 10.5.10, 10.6.9 +3drupal/core (Packagist): 10.4.10, 10.5.10, 10.6.9 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrupalDrupal core8.9.0 to before 10.4.10; 10.5.0 to before 10.5.10; 10.6.0 to before 10.6.9; 11.0.0 to before 11.1.10; 11.2.0 to before 11.2.12; 11.3.0 to before 11.3.1010.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10Patch availableCNA
—drupal/core (Packagist)8.9.0 to before 10.4.1010.4.10Patch availableGHSA-ghwc-95x2-682j
—drupal/core (Packagist)10.5.0 to before 10.5.1010.5.10Patch availableGHSA-ghwc-95x2-682j
—drupal/core (Packagist)10.6.0 to before 10.6.910.6.9Patch availableGHSA-ghwc-95x2-682j
—drupal/core (Packagist)11.0.0 to before 11.1.1011.1.10Patch availableGHSA-ghwc-95x2-682j
—drupal/core (Packagist)11.2.0 to before 11.2.1211.2.12Patch availableGHSA-ghwc-95x2-682j
—drupal/core (Packagist)11.3.0 to before 11.3.1011.3.10Patch availableGHSA-ghwc-95x2-682j
  • Drupal core VendorDrupal Affected 8.9.0 to before 10.4.10; 10.5.0 to before 10.5.10; 10.6.0 to before 10.6.9; 11.0.0 to before 11.1.10; 11.2.0 to before 11.2.12; 11.3.0 to before 11.3.10 Fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 Patch available CNA
  • drupal/core (Packagist) Vendor— Affected 8.9.0 to before 10.4.10 Fixed in 10.4.10 Patch available GHSA-ghwc-95x2-682j
  • drupal/core (Packagist) Vendor— Affected 10.5.0 to before 10.5.10 Fixed in 10.5.10 Patch available GHSA-ghwc-95x2-682j
  • drupal/core (Packagist) Vendor— Affected 10.6.0 to before 10.6.9 Fixed in 10.6.9 Patch available GHSA-ghwc-95x2-682j
  • drupal/core (Packagist) Vendor— Affected 11.0.0 to before 11.1.10 Fixed in 11.1.10 Patch available GHSA-ghwc-95x2-682j
  • drupal/core (Packagist) Vendor— Affected 11.2.0 to before 11.2.12 Fixed in 11.2.12 Patch available GHSA-ghwc-95x2-682j
  • drupal/core (Packagist) Vendor— Affected 11.3.0 to before 11.3.10 Fixed in 11.3.10 Patch available GHSA-ghwc-95x2-682j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*8.9.0 to before 10.4.10; 10.5.0 to before 10.5.10; 10.6.0 to before 10.6.9; 11.0.0 to before 11.1.10; 11.2.0 to before 11.2.12; 11.3.0 to before 11.3.10VulnerableDrupal
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.9.0 to before 10.4.10; 10.5.0 to before 10.5.10; 10.6.0 to before 10.6.9; 11.0.0 to before 11.1.10; 11.2.0 to before 11.2.12; 11.3.0 to before 11.3.10 Vulnerable ·Drupal

Remediation

  • Fix · CNA Drupal core (Drupal) Fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
  • Fix · GHSA-ghwc-95x2-682j drupal/core (Packagist) Fixed in 10.4.10 Advisory →
  • Fix · GHSA-ghwc-95x2-682j drupal/core (Packagist) Fixed in 10.5.10 Advisory →
  • Fix · GHSA-ghwc-95x2-682j drupal/core (Packagist) Fixed in 10.6.9 Advisory →
  • Fix · GHSA-ghwc-95x2-682j drupal/core (Packagist) Fixed in 11.1.10 Advisory →
  • Fix · GHSA-ghwc-95x2-682j drupal/core (Packagist) Fixed in 11.2.12 Advisory →
  • Fix · GHSA-ghwc-95x2-682j drupal/core (Packagist) Fixed in 11.3.10 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-05-22 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-9082
  3. 2026-10-03 Alias added: GHSA-ghwc-95x2-682j
  4. 2026-10-07 CISA SSVC decision points changed
  5. 2026-10-25 EPSS moved to the 99th percentile and above

References

Patch 1

Advisory 1

Other 1

  • TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
  • TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
  • TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
  • TI-2020-18513 Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal… KEVCVSS 3.1HIGH 7.5
See all 278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences