CVE-2026-9082

Name of the Vulnerable Software and Affected Versions Drupal Core versions 8.9.0 through 10.4.9 Drupal Core versions 10.5.0 through 10.5.9 Drupal Core versions 10.6.0 through 10.6.8 Drupal Core versions 11.0.0 through 11.1.9 Drupal Core versions 11.2.0 through 11.2.11 Drupal Core versions 11.3.0 through 11.3.9

Description An unauthenticated SQL injection flaw exists in the database abstraction API of Drupal Core, specifically within the PostgreSQL EntityQuery condition handler. The issue occurs when attacker-controlled PHP array keys, such as filter[...][condition][value][malicious key], are concatenated directly into SQL identifiers without proper sanitization. This vulnerability exclusively affects sites using PostgreSQL databases. Remote anonymous users can exploit this to achieve full database access, exfiltrate sensitive data, escalate privileges to Administrator, and potentially execute arbitrary shell commands on the host server via Remote Code Execution (RCE) if database permissions are misconfigured (e.g., allowing COPY FROM PROGRAM). Over 15,000 attack probes against approximately 6,000 sites across 65 countries have been detected, with gaming and financial services being primary targets.

Recommendations Update Drupal Core to version 10.4.10. Update Drupal Core to version 10.5.10. Update Drupal Core to version 10.6.9. Update Drupal Core to version 11.1.10. Update Drupal Core to version 11.2.12. Update Drupal Core to version 11.3.10. Restrict user roles that have the ability to update Twig templates via Views or contributed modules. Route production traffic through a Web Application Firewall (WAF) to filter malicious nested array payload signatures. Review PostgreSQL and WAF logs for unusual anonymous user queries or structural query modifications.