Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
Summary: CISA added CVE-2026-9082, an SQL injection flaw in all supported versions of Drupal Core with a CVSS score of 6.5, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, less than two days after Drupal released fixes. Imperva reported over 15,000 attack attempts against almost 6,000 individual sites in 65 countries, with gaming and financial services sites accounting for almost 50% of attacks and most activity appearing to be probing for vulnerable PostgreSQL-backed configurations.
What you should know: Attackers found and began probing this flaw within two days of the patch, and Imperva's 15,000 attempts show how fast scanning follows disclosure - with successful exploitation able to move from probing to data extraction or privilege escalation.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-9082
- Related
- CVE-2026-9082: Drupal Core SQL Injection Vulnerability Known Exploited Vulnerabilities · May 22, 2026