SECURITYMay 23 · 07:23 UTCTHE HACKER NEWS[email protected] (The Hacker News)

Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

CISA has added a critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core to its KEV catalog due to active exploitation. The flaw affects all supported versions of Drupal Core and carries a CVSS score of 6.5.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

U.S. Cybersecurity and Infrastructure Security AgencyorganizationCISAorganizationDrupal CoretopicCVE-2026-9082topicSQL InjectiontopicKnown Exploited Vulnerabilities (KEV)topic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYApr 29 · 05:34 UTC
LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure
SECURITYApr 14 · 05:39 UTC
CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software
SECURITYMay 3 · 06:26 UTC
CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
SECURITYMay 22 · 05:47 UTC
CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
SECURITYApr 15 · 12:37 UTC
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
SECURITYMay 22 · 13:14 UTC
Drupal: Critical SQL injection flaw now targeted in attacks