Drupal Vulnerability in Hacker Crosshairs Shortly After Disclosure

Drupal is detecting attempts to exploit CVE-2026-9082, a highly critical vulnerability patched during the week. The flaw affects an API intended to sanitize database queries to prevent SQL injection. A vulnerability in the API allows specially crafted requests to trigger arbitrary SQL injection on sites using PostgreSQL. Unauthenticated attackers can exploit the issue to obtain information and, in some cases, achieve privilege escalation and remote code execution. Drupal expected an exploit to appear within hours or days and alerted users before the May 20 patch release. The CVE risk score was raised from 20 to 23 after exploit attempts were detected in the wild. Imperva observed over 15,000 exploitation attempts targeting nearly 6,000 sites in 65 countries, with many attacks focused on gaming and financial services. The observed activity suggests reconnaissance and validation that could rapidly shift to data extraction or privilege escalation.

"Drupal is warning users that it's already seeing attempts to exploit CVE-2026-9082, the highly critical vulnerability patched this week. The vulnerability affects an API designed to ensure that database queries are sanitized to prevent SQL injection. "A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases," Drupal explains."

"The flaw can be exploited by unauthenticated attackers to obtain information and in some cases for privilege escalation and remote code execution. Drupal predicted that an exploit for CVE-2026-9082 may be created within hours or days of disclosure and alerted users prior to the patch's release on May 20. The CMS powers hundreds of thousands of websites, but the security hole only impacts sites that use PostgreSQL, and Drupal believes less than 5% are affected."

"However, the advisory for CVE-2026-9082 was updated on March 22 to inform users that the risk score has been updated from 20 to 23 "to reflect that exploit attempts are now being detected in the wild". It's worth noting that Drupal uses the NIST CMSS scoring system for vulnerabilities and the maximum risk rating is 25."

"Imperva reported seeing more than 15,000 exploitation attempts targeting nearly 6,000 sites across 65 countries. Almost half of the attacks were aimed at gaming and financial services websites. "This pattern suggests attackers and scanners are primarily attempting to identify exposed Drupal sites running vulnerable PostgreSQL-backed configurations. While the activity is currently dominated by reconnaissance and validation, the nature of the vulnerability means successful exploitation could quickly move from probing to data extraction or privilege escalation," the security firm warned."

Read at SecurityWeek