Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks
A "highly critical" security flaw in Drupal Core that might be used by attackers to accomplish remote code execution, privilege escalation, or information disclosure has prompted Drupal to release security upgrades.
According to CVE.org, the vulnerability has a CVSS score of 6.5 out of 10.0 and is being tracked as CVE-2026-9082. According to Drupal, a database abstraction API used in Drupal Core to verify queries and make sure they are cleaned up against SQL injection attacks is the source of the issue.
According to the report, a flaw in this API enables an attacker to submit specially constructed queries, leading to arbitrary SQL injection for websites that use PostgreSQL databases. Information disclosure, privilege escalation, remote code execution, and other attacks may result fr...