CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
- Published
- May 20, 2026
- Updated
- Oct 7, 2026
- Assigning CNA
- drupal
- Evidence observed
- May 22, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 96.8%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Sources
modules/auxiliary/scanner/http/drupal_pgsql_entityquery_sqli.rb
Metasploit Framework modulesDeclared conditions
- verification: check_declared($.auxiliary_scanner/http/drupal_pgsql_entityquery_sqli.check)
http/cves/2026/CVE-2026-9082.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
- CVE-2026-9082Informational
CVE-2026-9082
- CVE-2026-9082Exploit
Drupal Core PostgreSQL SQLi to RCE via /user/login (CVE-2026-9082 / SA-CORE-2026-004)
Drupal Core PostgreSQL SQL Injection PoC - CVE-2026-9082. Ethical PoC for the Drupal vulnerability allowing anonymous SQL injection through the JSON:API module on PostgreSQL-backed sites.
- drupal-cve-2026-9082-checkerScanner
Drupal CVE-2026-9082 Blind SQL Injection Checker
- drupal-jsonapi-sqli-scannerExploit
Scanner: CVE-2026-9082 Drupal PostgreSQL SQLi via JSON:API — Python scanner for unauthenticated SQLi leading to RCE (CISA KEV)
- CVE-2026-9082Scanner
Semi-passive scanner that detects Drupal installations vulnerable to CVE-2026-9082 (PostgreSQL SQL injection) via fingerprinting, version detection, and endpoint probing without sending payloads.
PoC for CVE-2026-9082 (Drupal SA-CORE-2026-004) Drupal Core SQLi
Exploit for CVE-2026-9082, a Drupal JSON:API PostgreSQL SQL injection that escalates to RCE via preload library, with a local lab for testing.
CVE-2026-9082 | SA-CORE-2026-004
cve poc
- CVE-2026-9082-Mass_ScannerScanner
Mass Scanner For Drupal Exploit CVE-2026-9082
Proof-of-concept exploit for CVE-2026-9082. Python script that demonstrates remote code execution against a target URL for security testing and vulnerability validation.
cardosource · php · Jun 1, 2026
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.