CVE-2026-9082: Unauthenticated SQLi in Drupal Core (PostgreSQL) Under Mass Exploitation; CISA KEV Added, 15K Attack Attempts Observed

CVE-2026-9082, a highly critical (Drupal score 23/25) unauthenticated SQL injection flaw in Drupal's database abstraction API affecting PostgreSQL-backed installations across versions 8.9 through 11.3.9, moved from patch release to active in-the-wild exploitation in under 48 hours. Imperva observed over 15,000 attack attempts targeting nearly 6,000 individual sites across 65 countries, with gaming and financial services sites comprising nearly 50% of targets. CISA added the flaw to its KEV catalog on May 22 with a May 27 remediation deadline for federal agencies; defenders should note that sites not on PostgreSQL still require patching due to bundled Symfony and Twig upstream fixes.

CISA added the flaw to its KEV catalog on May 22 with a May 27 remediation deadline for federal agencies; defenders should note that sites not on PostgreSQL still require patching due to bundled Symfony and Twig upstream fixes.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.