SA-CORE-2026-004 covers CVE-2026-9082, a 23/25 (on Drupal’s own risk scale) SQL injection in Drupal’s database abstraction API that hits PostgreSQL-backed sites across 8.9.0 through 11.3.9 and is exploitable by anonymous users: information disclosure, and in some cases privilege escalation or RCE. Patches landed in 11.3.10 / 11.2.12 / 11.1.10 / 10.6.9 / 10.5.10 / 10.4.10 (with best-effort backports for unsupported Drupal 8 and 9), and exploit attempts were already being seen in the wild by May 22. Notably, a cascade of public PoCs landed within a day of disclosure, next to a written vulnerability report. At that point the advisory still said 20/25; Drupal only raised it to 23/25 on May 22 once exploit attempts showed up, so apparently a mere 20/25 on anonymous-reachable SQLi is plenty of motivation.
