29MAY

Drupal SQL flaw hits PostgreSQL sites

3 min read

14:17UTC

Drupal rated CVE-2026-9082 Highly Critical at 23 out of 25; attackers logged 15,000 attempts within 48 hours, yet the flaw touches under 5 per cent of installs.

← Back to GitHub's own code cloned via VS Code add-on Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Drupal's fastest patch deadline covered under 5 per cent of installs, separating KEV urgency from actual exposure.

Drupal rated its own flaw "Highly Critical" at 23 out of 25, a SQL injection in the content-management system's database-abstraction layer carrying CVE-2026-9082 at CVSS 6.5⁠¹. SQL injection works by smuggling malicious input into a database query. The patch landed around Wednesday 20 May; CISA added it to KEV on Friday 22 May with a five-day federal deadline of Wednesday 27 May, the tightest of the window⁠².

The flaw is PostgreSQL only, and PostgreSQL-backed Drupal is under 5 per cent of the install base, which is the calibration point a buyer needs. The Drupal severity rating measures how bad the bug is where it bites; it says nothing about how many installs it can reach. An asset owner who triages purely on the KEV deadline will over-rotate on a flaw that cannot touch 95 per cent of their Drupal estate, while the owner who knows which database backs each site can stand most of them down. KEV inclusion confirms exploitation; the risk calculation still belongs to whoever knows the backend.

Imperva, the Thales-owned application-security firm, logged more than 15,000 attack attempts against roughly 6,000 sites across 65 countries within 48 hours, with gaming and financial-services sites taking about half⁠³. The catalogue itself grew from 1,585 entries a fortnight earlier to 1,606 in this window, a velocity that the proposed CISA cuts have not slowed and that makes exposure-aware triage, not deadline proximity, the only sustainable filter.

Deep Analysis

In plain English

Drupal is a website-building platform used by governments, universities, and large companies to publish content online. It runs on a variety of underlying database systems that store all the site's data, text, and user records. A security flaw, given the label CVE-2026-9082, affects only Drupal installations that use PostgreSQL as their database, which is a minority of all Drupal sites. The flaw lets attackers inject malicious database commands through normal website forms, potentially reading or altering site data without needing an account. The US government's cyber agency CISA listed this flaw as requiring urgent action on 22 May 2026, with a five-day deadline. Within 48 hours of the flaw becoming public, security researchers at Imperva observed over 15,000 attack attempts against around 6,000 websites in 65 countries. The attacks hit gaming and financial-services sites hardest. Organisations running government websites on Drupal with PostgreSQL databases are among the most exposed, even though they represent a small fraction of all Drupal installations.

Deep Analysis

Root Causes

Drupal's database-abstraction layer (DBAL) wraps database queries to make Drupal portable across MySQL, MariaDB, PostgreSQL, and SQLite. The SQL injection in CVE-2026-9082 arises from a parameter-quoting inconsistency in the PostgreSQL driver: PostgreSQL's handling of certain Unicode character sequences in parameterised queries differs from the behaviour the Drupal DBAL assumed, allowing a crafted input to escape the parameter context and inject arbitrary SQL.

This driver-level discrepancy was not exposed by Drupal's cross-database test suite because the test cases were written against the MySQL behaviour as the reference implementation.

The under-5% PostgreSQL install base is a consequence of Drupal's hosting market: shared hosting providers, which serve the majority of Drupal sites by install count, default to MySQL or MariaDB because of lower operational cost.

PostgreSQL-backed Drupal installations are disproportionately concentrated in government, university, and enterprise deployments, which run dedicated database infrastructure. This means the vulnerable population, while small by install count, is over-represented in high-value target categories.

The five-day KEV deadline, the tightest of any flaw in the 20-29 May window, reflects CISA's observation that 48-hour mass exploitation began before most organisations could complete a standard change-management cycle. For the government and university operators running PostgreSQL-backed Drupal, the deadline was functionally a fire-drill.

Escalation

Mass exploitation within 48 hours of patch release is now the expected pattern for Drupal CVEs rated Highly Critical, following the Drupalgeddon precedent from 2014. The KEV deadline was set to match the exploitation timeline, not the other way around. The gaming and financial-services concentration suggests financially motivated actors scanning for credential and payment-data targets.

What could happen next?

Risk
Government and university operators running PostgreSQL-backed Drupal, who disproportionately use this database configuration, face a higher per-site compromise probability than the under-5% install-base figure suggests, because scanner density tracks target value rather than install frequency.
Immediate · Assessed
Meaning
The 7-point divergence between Drupal's 23/25 severity rating and CVSS 6.5 for the same CVE demonstrates that single-score vulnerability triage is insufficient for CMS platforms where deployment configuration determines exploitability, a problem Rapid7 and Qualys have both raised in published research.
Medium term · Assessed
Consequence
Organisations relying solely on CVSS-threshold patch-automation policies would have deprioritised CVE-2026-9082 against higher-scoring flaws active in the same week, including Cisco SD-WAN CVE-2026-20182 at CVSS 10.0, and may have missed the five-day deadline.
Immediate · Assessed

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: CVE-2014-3704 ('Drupalgeddon'), a SQL injection in Drupal 7's database API layer, followed the identical structural pattern: a mass exploitation wave began within seven hours of Drupal's security advisory, with automated scanning tools probing millions of Drupal installations by the end of the first day. Drupal rated it Highly Critical (25/25); CVSS gave it 7.5.

The Drupal Security Team issued a post-mortem noting that any Drupal 7 installation not patched within seven hours of the advisory should be assumed compromised. The 48-hour exploitation window for CVE-2026-9082 is slower than Drupalgeddon, partly because the PostgreSQL constraint limits the vulnerable population to under 5% of Drupal installations, reducing the density of scannable targets.

Counter-parallel: The 2021 Accellion File Transfer Appliance exploitations followed a different pattern: a small target population (roughly 300 customer installations globally), high-value targets within that population (government agencies, law firms, pharmaceutical companies), and a financially motivated threat actor (Cl0p) that curated targets rather than mass-scanning.

CVE-2026-9082's observed exploitation by gaming and financial-services sites suggests opportunistic mass-exploitation rather than curation, which reduces per-victim dwell time and increases detection probability.

Consensus view: Rapid7's vulnerability research team notes that Drupal's 25-point severity scale assesses exploitability, business impact, and deployment context together, whereas CVSS v3.1 scores only the technical vulnerability characteristics in isolation.

CVE-2026-9082 scores 23/25 on Drupal's scale (Highly Critical) but only 6.5 on CVSS v3.1 because the CVSS score reflects the requirement for authenticated access and relatively limited scope of impact per session, while Drupal's score weighs the fact that mass exploitation of a CMS database layer typically yields full content-management and user-credential access. The gap between the two scores illustrates a known tension in vulnerability triage: CVSS-based patch-prioritisation systems would rank this below dozens of higher-CVSS flaws that pose lower practical risk.

Counter-view: Qualys's TruRisk research team argues that the CVSS 6.5 score, combined with the under-5% affected install base, is precisely the correct signal for organisations outside the PostgreSQL-backed Drupal population: the Drupal severity score communicates business impact to CMS administrators, while CVSS communicates exploitability to security operations Teams, and conflating the two scales produces over-prioritisation of flaws in the minority install configuration.

On this reading, the five-day KEV deadline was calibrated to PostgreSQL-backed Drupal operators specifically, not the broader Drupal ecosystem.

Key tension: Whether vulnerability triage programmes should adopt a CMS-vendor severity scale alongside CVSS for web-platform CVEs, or whether the existence of multiple competing severity scales for the same CVE creates worse triage outcomes by requiring asset owners to know which scale applies to their deployment configuration before they can interpret the urgency signal.

Sources:The Hacker News·Tenable·CISA

Mentions:Thales →Known Exploited Vulnerabilities →Rapid7 →Imperva →Tenable →CVE-2026-9082 →PostgreSQL →Drupal →CISA →

First Reported In

Update #5 · GitHub's own code cloned via VS Code add-on

The Hacker News· 29 May 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.