Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks

Drupal Core vulnerability CVE-2026-9082 enables SQL injection attacks on PostgreSQL sites, potentially leading to information disclosure, privilege escalation, or remote code execution.

• •CVSS score of 6.5, affecting database abstraction API used for query validation
• •Anonymous attackers can exploit by sending specially crafted requests
• •Affects Drupal 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, 10.4.10
• •PostgreSQL sites vulnerable; Drupal 7 unaffected
• •Includes upstream patches for Symfony and Twig in supported versions

This summary was automatically generated by AI based on the original article and may not be fully accurate.