Critical Security Update for Drupal Core: What Site Owners Should Do Now
The Drupal Security Team published security advisory SA-CORE-2026-004 on May 20, 2026. The vulnerability is classified as "Highly Critical" and affects Drupal core. Drupal website operators should install the provided updates promptly.
Official announcement from the security team
As in the past, the Drupal security team has announced the vulnerability in an advisory on Drupal.org.
The vulnerability is tracked under the identifier CVE-2026-9082 and involves an SQL injection flaw within the Drupal Core Database Abstraction API. According to the security advisory, the vulnerability can be exploited by unauthenticated attackers.
What is the problem?
Drupal uses a database abstraction API to securely process database queries and prevent SQL injection attacks.
However, a vulnerability identified as SA-CORE-2026-004 has been discovered where specially crafted requests can lead to SQL injection. Installations using PostgreSQL as their database are particularly affected.
Depending on the configuration, a successful attack can have the following impacts, among others:
- Access to sensitive data
- Manipulation or deletion of content
- Privilege escalation
- Remote Code Execution (RCE) in specific cases
A particularly critical aspect is that the vulnerability can be exploited anonymously—that is, without a valid login.
Why the update is important even without PostgreSQL
According to the Drupal Security Team, the actual SQL injection vulnerability affects only PostgreSQL-based installations. Nevertheless, the Security Team strongly recommends that all site operators update promptly.
The reason:
The released core updates also include security patches for key dependencies such as Symfony and Twig. Depending on the modules and configurations in use, other Drupal installations could therefore also be affected.
Furthermore, initial scanning and attack activity was observed shortly after the advisory was published.
Which Drupal versions should be updated?
The Drupal Security Team recommends the following target versions:
| Version Used | Recommende Update |
|---|---|
| Drupal 11.3.x | 11.3.10 |
| Drupal 11.2.x | 11.2.12 |
| Drupal 11.1.x / 11.0.x | 11.1.10 |
| Drupal 10.6.x | 10.6.9 |
| Drupal 10.5.x | 10.5.10 |
| Drupal 10.4.x und älter | 10.4.10 |
"Best-effort" patches have also been released for Drupal 9.5 and 8.9. However, these versions are already outside the scope of official security support.
Notes for agencies and larger platforms
For agencies and enterprise projects, it is advisable to prioritize production systems using PostgreSQL persistence.
The following measures may also be useful:
- short-term activation of additional WAF rules
- enhanced monitoring of unusual requests
- review of roles with Twig template permissions
- inspection of deployed contributed modules
Conclusion
SA-CORE-2026-004 is one of the most significant Drupal security advisories of the year so far. Although the SQL injection vulnerability itself directly affects only PostgreSQL-based installations, all site operators should apply the provided updates promptly.
The combination of a critical severity rating, the potential for anonymous exploitation, and already observed scanning activity makes a rapid response advisable.
Further information on the latest security advisories is available at www.Drupal.org.