orca.securityadvisoryOrca Security: CVE-2026-9082
Orca Security breaks down CVE-2026-9082, a critical unauthenticated SQL injection in Drupal core's database abstraction API affecting PostgreSQL-backed sites running versions 8.9.0 through 11.3.9. The flaw stems from insufficient query sanitization and can lead to full data exposure, privilege escalation, and in some configurations remote code execution; Drupal has shipped patched releases (e.g. 11.3.10, 10.6.9) and MySQL/MariaDB sites are unaffected by the SQLi itself but should still update for bundled Symfony/Twig fixes.
TL;DR Unauthenticated SQL injection (CVE-2026-9082) in Drupal core's database abstraction API hits PostgreSQL-backed sites; patch to the fixed 8.9–11.3 releases immediately.
CVEs named here
Technologies named here
- Drupal core
- Orca
- Drupal 7
- Symfony
- Twig
- Drupal
- PostgreSQL
Techniques named here
- SQL injection via database abstraction API
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup