EUVD-2026-31153
GHSA-ghwc-95x2-682j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify vulnerable Drupal endpoint
-
DeliverySend crafted HTTP request
-
ExploitInject SQL via unsanitized input
-
ExecutionExtract or modify database records
-
ImpactCompromise site/admin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating no special conditions - remote unauthenticated exploitation over the network against affected default configurations of Drupal core, requiring no authentication and no user interaction. The primary limiting factors are version-based: only Drupal core in the listed ranges (8.9.0-before 10.4.10, and the 10.5/10.6/11.0/11.2/11.3 branches before their respective fixed releases) is affected, so sites already on a patched release are not exploitable. The specific vulnerable feature, parameter, or code path is not detailed in the available description (the advisory text only states the SQLi class), so defenders should consult SA-CORE-2026-004 to identify whether a particular module, form, or request handler must be reachable; the low EPSS and SSVC 'Exploitation: none' suggest real-world exploitation may currently be targeted rather than opportunistic. |
| Impact | Signals here are genuinely conflicting and must be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) plus CISA KEV listing and multiple public exploits argue for top-priority, emergency patching. However, EPSS is only 0.01% (2nd percentile) and the SSVC decision framework records Exploitation: none with Technical Impact only 'partial' - directly at odds with the KEV 'actively exploited' claim and the CVSS 'high' impact across C/I/A. This discrepancy should be flagged: KEV listing overrides EPSS for prioritization (KEV reflects observed exploitation; EPSS is a 30-day probabilistic model that lags fresh, targeted campaigns), but the low EPSS and SSVC 'none' suggest exploitation may be targeted/limited rather than mass-automated, even though SSVC marks Automatable: yes. Net assessment: treat as a real, high-priority patch item because of confirmed KEV status and public exploit code, while recognizing the volume of exploitation may currently be narrow. Verify the SSVC/EPSS versus KEV conflict against the vendor advisory before de-prioritizing. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable Drupal endpoint that passes attacker-controlled input into a database query, injecting SQL that reads or modifies data or extracts administrator credentials. Given the low attack complexity (AC:L) and no required privileges or user interaction, and with public exploit code available (Exploit-DB 52608 and GitHub PoCs), the attack can be reproduced with minimal effort and potentially automated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10) allows attackers to inject arbitrary SQL against the site database, per SA-CORE-2026-004. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code (Exploit-DB 52608 and multiple public PoCs), and the CVSS 9.8 vector indicates unauthenticated remote exploitation. Notably, EPSS remains extremely low (0.01%) and SSVC lists exploitation as 'none', signaling either targeted rather than widespread activity or conflicting source data that defenders should treat cautiously while still prioritizing the patch given KEV status.
Earlier versions of this analysis (1)
SQL injection in Drupal Core across six major version branches (8.9.0 through 11.3.x) enables remote unauthenticated attackers to manipulate database queries with no required privileges or user interaction, as confirmed by CVSS vector AV:N/AC:L/PR:N/UI:N. The vulnerability yields partial confidentiality and integrity impact per CVSS - enabling data enumeration and limited data manipulation - but does not grant full database control or server compromise. No active exploitation is confirmed (not listed in CISA KEV; SSVC exploitation status: none), but SSVC flags this as automatable, making opportunistic mass scanning against the large global Drupal install base a credible near-term risk.
RemediationAI
Upgrade Drupal core to a fixed release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10 (Vendor-released patch per SA-CORE-2026-004 at https://www.drupal.org/sa-core-2026-004); sites still on 8.9.x/9.x/early 10.x should move to at least 10.4.10. Because this is confirmed in the CISA KEV catalog with public exploits, patch on an emergency timeline and prioritize internet-facing sites. If immediate patching is not possible, restrict access to the site (place it behind authentication, VPN, or IP allowlisting) and deploy a WAF rule set to detect and block SQL injection patterns against Drupal endpoints as an interim control - noting that WAF signatures can be bypassed and may cause false positives on legitimate content, so they are a stopgap, not a substitute for the update. After patching, review database logs and audit for signs of prior compromise (unexpected users, altered content, exfiltration) given active exploitation, and rotate credentials if intrusion is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Drupal core is a widely deployed PHP content management framework backed by a relational database accessed through its database abstraction layer (the Database API and its query builders). This vulnerability is a CWE-89 SQL Injection: improper neutralization of special elements in a SQL command, meaning attacker-controlled input reaches a query without adequate parameterization or escaping. The single CPE (cpe:2.3:a:drupal:drupal_core:*:*:*:*:*:*:*:*) confirms the defect is in core itself rather than a contributed module, so it affects the base platform used by every Drupal installation in the listed version ranges regardless of which contrib modules are enabled. Root cause of the CWE-89 class is dynamic query construction that concatenates untrusted data instead of using bound parameters/prepared statements.
Know when Drupal Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQL injection (AV:N/AC:L/PR:N/UI:N) allowing database read, modification, and disruption yields high confidentiality, integrity, and availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
7DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Articles & Coverage 1
Executive ViewAI
A critical SQL injection in Drupal core (CVE-2026-9082) allows unauthenticated attackers to directly access and manipulate site databases; it is confirmed actively exploited (CISA KEV). This affects all supported Drupal versions and requires immediate patch deployment to prevent data theft and system compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Drupal Core
View allObject injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged auth
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious s
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamica
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by for
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenti
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticate
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x t
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server int
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core a