Score elevated to 9.8 because this CVE is listed on the CISA Known Exploited Vulnerabilities catalog (added 2026-05-22), indicating real-world exploitation has been confirmed by US federal agencies. NVD baseline CVSS 9.8 retained for reference. Confidence: HIGH.
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
May 20, 2026
July 23, 2026
Known Exploited Vulnerabilities Catalog | CISA. Listed in CISA Known Exploited Vulnerabilities catalog.
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| drupal/core | 11.3.0 ... 11.3.9 (10 versions) | 11.3.10 | — |
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
Showing the most recent 100 of 246 total refreshes for this CVE.
Working exploit code is in the public domain (1 Metasploit module) (5 GitHub PoCs) (1 Exploit-DB entry). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
Drupal Core 10.5.5 - Error-Based SQL Injection
Open source ↗Drupal CVE-2026-9082 Blind SQL Injection Checker
Open source ↗Scanner: CVE-2026-9082 Drupal PostgreSQL SQLi via JSON:API — Python scanner for unauthenticated SQLi leading to RCE (CISA KEV)
Open source ↗Drupal Core PostgreSQL SQL Injection PoC - CVE-2026-9082. Ethical PoC for the Drupal vulnerability allowing anonymous SQL injection through the JSON:API module on PostgreSQL-backed sites.
Open source ↗CVE-2026-9082 | SA-CORE-2026-004
Open source ↗Drupal Core PostgreSQL EntityQuery SQL Injection
Open source ↗Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
Open source ↗See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-9082
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.