Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks
Summary: Drupal released security updates for a "highly critical" Drupal Core vulnerability, tracked as CVE-2026-9082 with a CVSS score of 6.5, in a database abstraction API used to validate queries against SQL injection. Drupal said specially crafted requests allow arbitrary SQL injection on sites using PostgreSQL databases, exploitable by anonymous users, and Searchlight Cyber has released two working proof-of-concept exploits gated on PostgreSQL as the backend.
Key Takeaway: Anonymous users can reach this flaw on any PostgreSQL-backed Drupal deployment, and working proof-of-concept code is already public - while Drupal 8, 9, and 11.1.x and below are end-of-life and receive only best-effort patches that leave other known vulnerabilities in place.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-9082
- Related
- CVE-2026-9082: Drupal Core SQL Injection Vulnerability Known Exploited Vulnerabilities · May 22, 2026