CVE-2026-9082

CVE-2026-9082 is a SQL injection vulnerability in Drupal core that has persisted across seven years and versions 8.9 through 11.3. If you maintain any Drupal installation, treat this as incident response, not routine patching. The seven-year persistence is the real story. This vulnerability survived the 8.x end-of-life, the entire 9.x lifecycle, and migrated into 10.x and 11.x. That's not a single missed sanitization — it's a code path that survived multiple architectural reviews, security audits, and major version transitions. The question you should be asking isn't just 'am I patched?' but 'what other legacy query patterns in my current version haven't been audited the same way?' The simultaneous existence of separate patches for 10.4.x, 10.5.x, 10.6.x, 11.1.x, 11.2.x, and 11.3.x tells us something important about the codebase state. A vulnerability requiring divergent fixes across six active branches indicates either the vulnerable pattern was replicated by multiple developers across parallel tracks, or the fix required architectural changes that couldn't be uniformly propagated. Either interpretation suggests the blast radius of any database-layer change in Drupal is larger than the project admits. With an EPSS score of 0.88319, this has one of the highest exploitation probability metrics recorded for a CMS vulnerability. Combined with CISA KEV confirmation of active exploitation, the disclosure-to-mass-exploitation window was effectively zero. If you're on Drupal 9.x: those versions are unpatched and end-of-life. No fix is coming. Those installations are now permanently compromised infrastructure — not a risk to be managed with compensating controls, but infrastructure that should be taken offline. WAF rules catch known patterns but not novel payloads. Network isolation limits blast radius but doesn't remediate a fundamentally compromised application. The honest answer is that Drupal 9.x systems are now training infrastructure for attackers who will refine exploits against them before deploying against hardened 10.x and 11.x targets.

Reviewed through automated stages and approved by a human before publication.