CVE-2026-9082 is an SQL Injection vulnerability (CWE-89) in Drupal core that affects multiple specific versions including 8.9.0, 10.5.0, 10.6.0, 11.0.0, 11.2.0, and 11.3.0. The vulnerability allows remote attackers to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The CVSS 3.1 base score is 9.8, reflecting critical impact with full confidentiality, integrity, and availability compromise possible without authentication or user interaction. No official remediation level or patch information is provided in the data, and no known exploits in the wild are reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected Drupal core installations. This can lead to complete compromise of the database, including unauthorized data disclosure, data modification, and potential denial of service. The critical CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the official Drupal vendor advisory for current remediation guidance. Since no patch or official remediation level is provided in the available data, users should monitor Drupal's security advisories closely and apply any official updates or patches once released. Until a fix is available, consider restricting access to vulnerable Drupal instances and applying any recommended temporary mitigations from Drupal's security team.