Drupal Core SQL Injection Vulnerability CVE-2026-9082

May 21, 2026

SUMMARY

This is a follow-up to a notice alerting you to a critical vulnerability affecting sites running the Drupal Content Management System [1]. Please share this alert internally with IT admins and service owners who run the product so they are aware and know what actions to take to address this vulnerability. 

IMPACT

This vulnerability may lead to information disclosure, remote code execution, and privilege escalation. 

WHAT IS VULNERABLE

  1. Drupal 8.9.0 

  2. Drupal 9.0.x

  3. Drupal 10.4.9, 10.5.0 - 10.5.9, 10.6.0 -10.6.8

  4. Drupal 11.0.0 - 11.1.9, 11.2.0,11.3.0 - 11.3.9

NOT VULNERABLE

  1. Drupal sites that are not using PostgreSQL databases.

  2. Drupal 7.x is not affected as far as we know. Any Drupal 7 Sites hosted on Pantheon, including open Berkeley Platform sites, are automatically eligible for extended security support.

RECOMMENDATIONS

  1. Install the latest patched version:

    1. For Drupal 8.9.0, manually apply the Drupal 8.9 patch

    2. For Drupal 9.0.x, manually apply the Drupal 9.5 patch

    3. For Drupal 10.4.9, update to Drupal 10.4.10

    4. For Drupal 10.5.0-10.5.9, update to Drupal 10.5.10

    5. For Drupal 10.6.0-10.6.8, update to Drupal 10.6.9

    6. For Drupal 11.0.0 - 11.0.9, update to Drupal 11.1.10

    7. For Drupal 11.2.0, update to Drupal 11.2.12

    8. For Drupal 11.3.0-11.3.9, update to Drupal 11.3.10

  2. Sites hosted on Pantheon should apply the appropriate update as soon as possible. Contact the Web Platform Services team if you run a site on Pantheon if you need further clarification or assistance.

REFERENCES

  1. https://www.drupal.org/psa-2026-05-18

  2. https://www.drupal.org/sa-core-2026-004

  3. https://www.drupal.org/project/drupal/releases/11.3.10

  4. https://www.drupal.org/project/drupal/releases/11.2.12

  5. https://www.drupal.org/project/drupal/releases/10.6.9

  6. https://www.drupal.org/project/drupal/releases/10.5.10

  7. https://www.drupal.org/project/drupal/releases/10.4.10

  8. https://pantheon.io/drupal-7

If you have any questions about the vulnerability or would like some assistance patching or mitigating it, please contact security@berkeley.edu.