CVE-2026-9082Vulnerability
Drupal Core SQL Injection Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by Rapid7 · last reported
Last reported yesterday
CISA KEVAdded 22 May 2026
Fix due 27 May 2026
Used by ransomware: not knownCISA KEV catalogue
Fix due 27 May 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS15.7%
higher than 96% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 96% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions“CVE-2026-9082 (Drupal SQL injection) (Developed or referenced)”
-
Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!“Description: This adds a new module: drupal_pgsql_entityquery_sqli for CVE-2026-9082, an unauthenticated SQL injection in Drupal core's PostgreSQL EntityQuery condition handler.”
Indicators reported together
named in the same reports- hxxps://github[.]com/jafarov007in 1 report
- hxxps://github[.]com/rapid7/rex-bin_tools/pull/16in 1 report
- docs.metasploit[.]comin 1 report
- 45.227.254[.]43in 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2026-63030, CVE-2026-15409, CVE-2026-35616, CVE-2026-16232, CVE-2026-60137, CVE-2026-9198, CVE-2024-57727, CVE-2026-59774, CVE-2026-3576, CVE-2026-6826, CVE-2026-0265, CVE-2026-19681, CVE-2026-21820, CVE-2026-56274, CVE-2026-66066, CVE-2026-41940
Thanks — we review every report.