[KEV] CVE-2026-9082 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-9082 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-9082 is a SQL injection vulnerability in Drupal Core that exposes the database abstraction API to manipulation via specially crafted HTTP requests.

Technical Detail

The flaw exists in Drupal Core's database abstraction layer, where insufficient sanitization of user-supplied input allows an attacker to inject malicious SQL through crafted requests processed by the API. Successful exploitation can result in privilege escalation within the application, potentially granting administrative access to an otherwise unprivileged or unauthenticated user. From that elevated position, an attacker may achieve remote code execution on the underlying server, depending on the site's configuration and hosting environment.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this vulnerability to the Known Exploited Vulnerabilities catalog on May 22, 2026. The exploit maturity is rated Operational, meaning functional exploit code capable of reliably achieving the described impact is in active use and not limited to controlled research environments. Organizations running Drupal Core should treat this as an immediate threat rather than a theoretical risk.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability. Attribution may emerge as incident data is collected and analyzed.

What To Do

Apply the relevant Drupal Core security update immediately. Per CISA's Known Exploited Vulnerabilities catalog, federal agencies operating under BOD 22-01 are required to remediate this vulnerability or apply documented mitigations by the deadline specified in their KEV tracking guidance, with the addition date of May 22, 2026 as the reference point. Organizations should prioritize patching any internet-facing Drupal installations first, followed by internal instances. If patching cannot be completed immediately, consider restricting access to affected endpoints at the network perimeter and reviewing web application firewall rules for SQL injection signatures targeting Drupal's query patterns. Audit application and database logs for anomalous query structures or unexpected privilege changes, which may indicate prior or ongoing exploitation. Monitor Drupal's official security advisories at drupal.org/security for patch availability and version-specific guidance.