drupal core sql injection drew exploit attempts within two days

what happened

• On May 20, 2026, Drupal published SA-CORE-2026-004 for CVE-2026-9082, an SQL injection involving core's database abstraction API that anonymous users can exploit. The advisory now rates it Highly critical (23/25).[1,3]
• Drupal says the SQL injection only affects sites using PostgreSQL, but the releases for supported branches (11.3, 11.2, 10.6 and 10.5) also include Symfony and Twig security updates, and those third-party dependency updates apply to all sites.[1]
• Drupal says consequences include information disclosure and, in some cases, privilege escalation or remote code execution.[1]
• At 04:30 UTC on May 22, 2026, Drupal updated the risk score to reflect that exploit attempts were being detected in the wild, and CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalog the same day with a May 27 due date.[1,3,2]
• The NVD record lists a CVSS v3.1 base score of 9.8 (critical) submitted by a drupal.org source.[2]
• Fixed releases are 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10 and 10.4.10. Drupal provides patches that Drupal 9 and 8.9 sites can try applying manually, and 11.1.x, 11.0.x and 10.4.x and below are end-of-life.[1]