Drupal Core Vulnerability CVE-2026-9082 Allows Remote Code Execution and Privilege Escalation

Drupal has released security updates for a highly critical vulnerability in Drupal Core that could be exploited for remote code execution, privilege escalation, or information disclosure. The flaw, tracked as CVE-2026-9082, carries a CVSS score of 6.5 and resides in the database abstraction API. Attackers could manipulate database queries to execute arbitrary code or elevate privileges. The vulnerability affects all Drupal 9 and 10 installations that have not applied the latest patch.

Drupal's security team has issued a patch that validates input and sanitizes database calls. Site administrators are urged to apply the update immediately to prevent exploitation. The update also includes additional logging for failed query attempts. Failure to patch could expose sensitive data and compromise site integrity.