Drupal warns users that it has seen attempts to exploit CVE-2026-9082 and security firms are seeing attacks against thousands of websites.

Drupal released security updates for a highly critical Drupal Core vulnerability affecting sites that use PostgreSQL.

CVE-2026-9082 can be exploited without authentication for information disclosure, privilege escalation, and remote code execution.

Drupal is warning that hackers are attempting to exploit a "highly critical" SQL injection vulnerability announced earlier this week.

Drupal warns users that it has seen attempts to exploit CVE-2026-9082 and security firms are seeing attacks against thousands of websites.

Drupal CVE-2026-9082 exploitation hit 15,000 attempts across 65 countries, forcing urgent patches by May 27, 2026.