Drupal Core SQL Injection PostgreSQL RCE | MSSP Advisory

Drupal released an emergency patch for CVE-2026-9082, a maximum severity SQL injection vulnerability in its core database abstraction API that affects sites using PostgreSQL databases. The flaw allows attackers to send crafted requests that bypass query sanitization, leading to arbitrary SQL injection with potential for information disclosure and privilege escalation. The patch also updates underlying components Symfony and Twig due to upstream security issues.

Your RMM or PSA platform might run on Drupal for customer portals or internal documentation sites, and a successful SQL injection could expose your entire client database and credential stores. Every client running Drupal websites with PostgreSQL backends faces immediate data breach risk, and failing to alert them within hours puts your advisory credibility and contract compliance at risk.

📬