Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
CISA added CVE-2026-9082 to its KEV catalog as Drupal's critical SQL injection flaw in Core sees active exploitation. Over 15,000 attack attempts hit nearly 6,000 sites across 65 countries, targeting PostgreSQL-backed deployments. Patches are available for all supported versions.