This threat involves a SQL injection flaw in Drupal Core that was publicly patched. Despite the availability of a patch, attackers began exploiting the vulnerability within 48 hours, with 15,000 recorded attack attempts across 6,000 sites. The rapid exploitation attempts indicate active scanning and targeting of vulnerable Drupal sites. The source of this information is a Reddit cybersecurity post referencing the official Drupal security advisory (http://drupal.org/sa-core-2026-004). No CVSS score is provided, and no detailed technical exploit methods are described beyond the SQL injection nature of the flaw.

The vulnerability allows attackers to execute SQL injection attacks against Drupal Core, which can lead to unauthorized data access or manipulation. The active exploitation attempts shortly after patch release demonstrate that unpatched Drupal sites are at immediate risk. The impact is medium severity as per the source, reflecting significant but not necessarily critical compromise potential depending on site configuration and data sensitivity.

A patch for this SQL injection vulnerability in Drupal Core has been released by the vendor. Site administrators should apply the official Drupal security update immediately to prevent exploitation. Since the service is not cloud-hosted, remediation depends on timely patching by site operators. No vendor advisory content contradicts this guidance, so prompt patching is the recommended mitigation.