Drupal has patched a highly critical vulnerability that could allow threat actors to hack websites powered by the open source content management system (CMS).
The developers of the CMS had alerted users prior to the patch’s release that an exploit might be created within hours or days of disclosure.
The vulnerability, tracked as CVE-2026-9082 and rated ‘highly critical’ with a NIST CMSS score of 20 out of 25, affects an API designed to ensure that database queries are sanitized to prevent SQL injection attacks.
“A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases,” Drupal explains.
It warns that the flaw can be exploited without authentication to obtain information and in some cases for privilege escalation and remote code execution.
