Drupal SQL Injection Vulnerability CVE-2026-9082: Still Active, Still a Threat
Three months ago, CISA added CVE-2026-9082 to its known exploited vulnerabilities catalog. That was May 22nd. We're now well past the vendor remediation deadline of May 27th, and this SQL injection flaw in Drupal Core remains actively exploited in the wild. If you run a Drupal site and haven't patched yet, this post is the reality check you need.
What This Vulnerability Actually Does
The vulnerability exists in Drupal Core's database abstraction API. An attacker can send specially crafted requests that inject malicious SQL code into database queries. This isn't a theoretical risk—it directly enables privilege escalation, meaning an attacker can grant themselves admin-level access to your site. From there, remote code execution follows naturally, giving them full control over your server.
The practical impact: if you're running an unpatched Drupal site, assume active threat actors are trying to compromise it right now. This isn't something that will be fixed by a future patch if you ignore it. The exploit is being used in active attacks.
Why Detection Matters More Than You'd Think
Here's what most vulnerability notices won't tell you: the real problem isn't just that the flaw exists. It's that many organizations don't know whether they're running Drupal at all, or which version they're on. You might have inherited a Drupal installation from a contractor three years ago. It might be running on a subdomain you forgot about. The gap between "vulnerability exists" and "we know we have this" is where breaches happen.
That's your first job: inventory. Pull your asset list and identify every web application you operate. If Drupal is anywhere in your stack, you need to know the version right now.
Three Action Steps to Take This Week
Step One: Find and Verify Your Drupal Installations
Log into your hosting control panel, your cloud console, and any development environments you maintain. Search for Drupal installations. Check the CHANGELOG.txt file (usually at /CHANGELOG.txt on the web server) to confirm the version. Document each instance in a spreadsheet with the URL, version number, and whether it's production or development.
Step Two: Apply Patches or Apply Workarounds
Visit your Drupal admin dashboard for each installation. Check for security updates. Drupal should display a warning if you're running a vulnerable version. Apply the available patches immediately. If patches aren't available for your specific version, Drupal's security advisory will outline alternative mitigations—follow those instructions exactly. If your version is too old to patch and mitigations don't exist, you must discontinue that Drupal installation or replace it entirely.
Step Three: Check Access Logs and Plan Your Verification
Pull web server access logs from the past 90 days (covering the period since this exploit became public). Look for unusual requests to database-related endpoints or suspicious query strings. You won't find a smoking gun easily, but patterns of failed attacks often appear. If you see evidence of exploitation attempts, consider a forensic review. After patching, re-run a vulnerability scan to confirm the fix took hold.
What's Required Under Federal Guidance
If you operate a cloud service for customers or government agencies, BOD 22-01 applies to you. That order requires federal information systems to use only patched versions of open-source software. Drupal installations must be fully patched or removed. If you're uncertain whether BOD 22-01 affects your business, assume it does and patch anyway—the timeline has already passed.
The Ownership Question
Many small business owners defer security updates to developers or support contractors. Stop. Make yourself the owner of this decision. Call or email whoever manages your website today. Ask them directly: "Are we running Drupal, and is it patched against CVE-2026-9082?" Write down their answer. If you don't get a clear answer within 24 hours, escalate. This is not an optional task.