sign in--:--:--UTC

CVE-2026-9082

exploited in the wild

CVSS

6.5

Reports

10

First seen

May 21

Last seen

May 26

Affected product

Drupal Core

Associated actors

RondoDox ×2 Eagle Werewolf ×1 Fox Tempest ×1 Nimbus Manticore ×1 Phorpiex ×1 Qilin ×1 Safepay ×1 ShinyHunters ×1 Silver Fox ×1 TeamPCP ×1 Akira ×1 UNG0002 ×1

Recent reports

CISA Orders Federal Agencies to Patch Actively Exploited Drupal SQL Injection Flaw

Bleeping ComputerMay 26 Critical

High Threat Security Alert: CVE-2026-9082 Remote Code Execution in Drupal Products

GovCERT.HKMay 26 High

Check Point Threat Intelligence Report – 25 May 2026

Check Point ResearchMay 25 Critical

Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

The Hacker NewsMay 25 High

Drupal Core SQL Injection Vulnerability Actively Exploited, Added to CISA KEV

The Hacker NewsMay 23 Critical

Drupal Core Critical Vulnerability CVE-2026-9082 – Active Exploitation Confirmed

Canadian Centre AlertsMay 22 High

Drupal: Critical SQL injection flaw now targeted in attacks

Bleeping ComputerMay 22 High

CISA Adds Drupal Core SQL Injection Vulnerability to Known Exploited Catalog

CISA AdvisoriesMay 22 High

Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks

The Hacker NewsMay 21 Critical

Drupal Remote Code Execution Vulnerability (CVE-2026-9082)

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans