CVE-2026-9082

Warnung

Medienbericht

EPSS 84.63%
Veröffentlicht 20.05.2026 18:20:52
Zuletzt bearbeitet 21.05.2026 15:24:25
Quelle mlhess@drupal.org
CVE-Watchlists
Login
Unerledigt
Login

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.

This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Betroffene Produkte Warnungen 2 Metriken 2 CWE 1 Referenzen 10

CNA 1 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).

HerstellerDrupal

≫

Produkt Drupal core

Default Statusunaffected

Version 8.9.0

Version < 10.4.10

Status affected

Version 10.5.0

Version < 10.5.10

Status affected

Version 10.6.0

Version < 10.6.9

Status affected

Version 11.0.0

Version < 11.1.10

Status affected

Version 11.2.0

Version < 11.2.12

Status affected

Version 11.3.0

Version < 11.3.10

Status affected

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

22.05.2026: CISA Known Exploited Vulnerabilities (KEV) Catalog

Drupal Core SQL Injection Vulnerability

Schwachstelle

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen

20.05.2026:

https://www.cert.at/de/warnungen/2026/5/kritische-sicherheitslucke-in-drupal-core-updates-verfugbar

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	84.63%	0.997

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	3.9	2.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.