CISA flags Drupal Core SQLi (CVE‑2026‑9082) as actively exploited
The U.S. Cybersecurity and Infrastructure Security Agency added Drupal Core’s CVE‑2026‑9082 SQL injection flaw to its Known Exploited Vulnerabilities catalog, citing active attacks. The bug can let unauthenticated users execute arbitrary SQL, potentially leading to privilege escalation or remote code execution. Immediate patching is urged for all supported Drupal installations.