onyx

onyx --cves cve-2026-9082

CVE-2026-9082

N/AKEVNUCLEI ↗Drupal
score
1.9
cvss
—
epss
15.7%
published
—
kev added
2026-05-22
first seen

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-05-22 — Added to CISA KEVK2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Nuclei template: Drupal Core - Anonymous SQL Injection via PostgreSQL Entity QueryNscore2026-10-21: score 1.91.9epss2026-09-22: epss 90.0%2026-09-23: epss 90.0%2026-09-24: epss 15.7%2026-09-25: epss 15.7%2026-09-26: epss 15.7%2026-09-27: epss 15.7%2026-09-29: epss 15.7%2026-09-30: epss 15.7%2026-10-01: epss 15.7%2026-10-02: epss 15.7%2026-10-03: epss 15.7%2026-10-04: epss 15.7%2026-10-05: epss 15.7%2026-10-06: epss 15.7%2026-10-07: epss 15.7%2026-10-08: epss 15.7%2026-10-09: epss 15.7%2026-10-10: epss 15.7%2026-10-11: epss 15.7%2026-10-12: epss 15.7%2026-10-13: epss 15.7%2026-10-14: epss 15.7%2026-10-15: epss 15.7%2026-10-16: epss 15.7%2026-10-18: epss 15.7%2026-10-19: epss 15.7%2026-10-20: epss 15.7%2026-10-21: epss 15.7%15.7%mentions/day0no mentions in 30 days2026-09-22today
  1. Added to CISA KEV
  2. Tracked by Onyx
  3. Nuclei template Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Nuclei template

A verified check exists — you can scan for this today, and so can everyone else.

template
Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
severity
CRIT
first seen
nuclei -id CVE-2026-9082 -u https://target.example

Weaknesses

CWE-89

References 2