{"id":"CVE-2026-9082","kind":"vulnerability","aliases":["CVE-2026-9082"],"related":[],"title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal…","description":"WAF Release - 2026-06-09 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJune 9, 2026\n\n## WAF Release - 2026-06-09\n\nThis release introduces new detections for a critical SQL injection vulnerability in Drupal installations utilizing PostgreSQL (CVE-2026-9082), alongside targeted protection for an unsafe deserialization flaw in the Mirasvit Cache Warmer extension (CVE-2026-45247). Additionally, this release includes coverage for a prototype pollution vector in Axios (CVE-2026-40175) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic.\n\nKey Findings\n\n- CVE-2026-9082: A database abstraction vulnerability affects Drupal sites configured with a PostgreSQL backend. Remote, unauthenticated attackers can exploit this flaw via crafted inputs to inject malicious SQL commands and access or manipulate backend data.\n- CVE-2026-45247: A PHP Object Injection vulnerability exists in the Mirasvit Cache Warmer extension for Magento and Adobe Commerce. This flaw stems from unsafe deserialization of untrusted user input, enabling unauthenticated attackers to execute arbitrary code on the hosting server.\n- CVE-2026-40175: A prototype pollution vulnerability affects the Axios HTTP client library. Attackers can exploit this to inject malicious properties into the global JavaScript object prototype, potentially causing application crashes (Denial of Service) or executing unauthorized code depending on the application structure.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate database contents, or induce application crashes, leading to severe operational disruption or complete server compromise. These newly deployed signatures intercept these advanced malicious payloads at the edge before they can interact with vulnerable software configurations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...387cf935 | N/A | Axios - Prototype Pollution - CVE:CVE-2026-40175 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...417eb9e0 | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - Body | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...fd3857fd | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...aee241d2 | N/A | SQLi - Obfuscated Boolean - Body | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d8620070 | N/A | SQLi - Obfuscated Boolean - Headers | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e0be4d47 | N/A | Mirasvit Cache Warmer - PHP Object Injection - CVE:CVE-2026-45247 | N/A | Block | This is a new detection. |","summary":"Drupal Core has a SQL injection flaw in its database abstraction API that lets specially crafted requests run attacker-chosen SQL. The source says this can lead to privilege escalation and remote code execution, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-05-22T00:00:00+00:00","products":[{"name":"Drupal Core","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"drupal","fixed":["10.4.10"],"affected":">= 8.9.0, < 10.4.10","ecosystem":"vendor"},{"name":"drupal","fixed":["10.5.10"],"affected":">= 10.5.0, < 10.5.10","ecosystem":"vendor"},{"name":"drupal","fixed":["10.6.9"],"affected":">= 10.6.0, < 10.6.9","ecosystem":"vendor"},{"name":"drupal","fixed":["11.1.10"],"affected":">= 11.0.0, < 11.1.10","ecosystem":"vendor"},{"name":"drupal","fixed":["11.2.12"],"affected":">= 11.2.0, < 11.2.12","ecosystem":"vendor"},{"name":"drupal","fixed":["11.3.10"],"affected":">= 11.3.0, < 11.3.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","drupal","drupal-core","exploited","lab-disclosure","php","runtime","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Identify your Drupal Core version (unknown from sources; check composer.lock for drupal/core or run vendor/bin/drush status).\nCompare against the affected version range in the Drupal security advisory (unknown from sources).\nReview web server access logs for unusual requests to Drupal endpoints (unknown from sources).","fix":"Apply the vendor mitigation or patched Drupal Core release per the Drupal security advisory (exact version unknown from sources).\nIf no mitigation exists, discontinue use of the affected Drupal Core deployment as CISA directs.","status":"open","published_at":"2026-05-20T20:16:41+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:04+00:00","updated_at":"2026-10-24T18:56:54+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T20:34:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patched Drupal Core release per the Drupal security advisory (exact version unknown from sources).\nIf no mitigation exists, discontinue use of the affected Drupal Core deployment as CISA directs.","summary":"Drupal Core has a SQL injection flaw in its database abstraction API that lets specially crafted requests run attacker-chosen SQL. The source says this can lead to privilege escalation and remote code execution, and CISA lists it as actively exploited.","category":"runtime","who_cares":["drupal","drupal-core","php","self-hosted"],"confidence":0.6,"analyst_note":"Find the Drupal security advisory for CVE-2026-9082 to get affected and fixed versions, and confirm the mitigation steps; sources give only the KEV entry.","how_to_check":"Identify your Drupal Core version (unknown from sources; check composer.lock for drupal/core or run vendor/bin/drush status).\nCompare against the affected version range in the Drupal security advisory (unknown from sources).\nReview web server access logs for unusual requests to Drupal endpoints (unknown from sources).","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"critical"},"cost_usd":0.000421,"input_tokens":2056,"output_tokens":430,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-06':90C,106C '-09':91C,107C '-2026':18A,21A,125C,142C,157C,182C,218C,259C,373C,392C,412C,467C '-40175':158C,260C,374C '-45247':143C,219C,468C '-9082':19A,22A,126C,183C,393C,413C '2026':89C,102C,105C '387cf935':366C '417eb9e0':385C '9':101C 'abstract':55B,186C 'access':212C 'action':359C,361C 'activ':85B 'addit':144C 'adob':235C 'advanc':337C 'aee241d2':425C 'affect':188C,265C 'allow':308C 'alongsid':127C 'api':56B 'applic':287C,299C,320C 'arbitrari':252C,313C 'attack':64B,198C,249C,271C,310C 'attacker-chosen':63B 'attempt':174C 'axio':155C,267C,368C 'backend':195C,215C 'block':168C,376C,396C,416C,470C 'bodi':394C,430C 'boolean':177C,429C,445C 'bypass':173C 'cach':138C,229C,460C 'caus':286C 'changelog':92C,93C 'chosen':65B 'cisa':81B 'client':269C 'cloudflar':31B,99C,363C,382C,402C,422C,438C,454C 'code':78B,253C,295C,314C 'command':10A,210C 'comment':362C 'commerc':236C 'complet':328C 'compromis':330C 'configur':191C,350C 'content':317C 'core':24A,35B,46B 'could':307C 'coverag':148C 'craft':60B,204C 'crash':288C,321C 'critic':115C 'cve':17A,20A,124C,141C,156C,181C,217C,258C,371C,372C,390C,391C,410C,411C,465C,466C 'd8620070':441C 'data':216C 'databas':54B,185C,316C 'denial':289C 'depend':296C 'deploy':333C 'descript':357C 'deseri':133C,242C 'design':164C 'detect':112C,381C,401C,421C,437C,453C,475C 'disabl':432C,448C 'disclosur':39B 'disrupt':326C 'drupal':15A,16A,23A,25A,26A,27A,28A,29A,30A,32B,34B,45B,120C,189C,387C,407C 'drupal-cor':33B 'e0be4d47':457C 'edg':342C 'element':5A 'enabl':247C 'escal':75B 'execut':79B,251C,293C,312C 'exist':225C 'exploit':36B,86B,200C,273C,303C 'extens':140C,231C 'fd3857fd':405C 'find':180C 'flaw':51B,134C,202C,238C 'generic':162C 'global':281C 'header':446C 'host':44B,256C 'http':268C 'id':353C,356C 'identifi':166C 'impact':301C 'improp':1A 'improv':97C 'includ':147C 'induc':319C 'inject':12A,50B,117C,171C,207C,223C,276C,464C 'input':205C,246C 'instal':121C 'interact':346C 'intercept':335C 'introduc':110C 'javascript':282C 'june':100C 'key':179C 'lab':38B 'lab-disclosur':37B 'lead':72B,322C 'legaci':354C 'let':58B 'leverag':175C 'librari':270C 'list':82B 'log':375C,395C,415C 'logic':178C 'magento':233C 'malici':208C,277C,338C 'manag':364C,383C,403C,423C,439C,455C 'manipul':214C,315C 'mirasvit':137C,228C,459C 'n/a':367C,386C,406C,426C,431C,442C,447C,458C,469C 'neutral':2A 'new':94C,111C,161C,360C,380C,400C,420C,436C,452C,474C 'newli':332C 'obfusc':176C,428C,444C 'object':222C,283C,463C 'oper':325C 'payload':339C 'php':40B,221C,462C 'pollut':152C,263C,370C 'postgresql':123C,194C,388C,408C 'potenti':285C 'previous':358C 'privileg':74B 'properti':278C 'protect':129C 'prototyp':151C,262C,284C,369C 'releas':88C,104C,109C,146C 'remot':77B,196C 'request':61B 'rule':163C,352C,355C 'ruleset':351C,365C,384C,404C,424C,440C,456C 'run':62B 'runtim':41B 'say':69B 'self':43B 'self-host':42B 'server':257C,329C 'servic':291C 'sever':324C 'signatur':334C 'site':190C 'softwar':349C 'sophist':169C 'sourc':68B 'special':4A,59B 'sql':9A,11A,49B,66B,116C,170C,209C 'sqli':172C,389C,409C,427C,443C 'stem':239C 'structur':300C 'success':302C 'target':128C 'unauthent':197C,248C,309C 'unauthor':294C 'unsaf':132C,241C 'untrust':244C 'updat':95C 'uri':414C 'use':6A 'user':245C 'util':122C 'vector':153C 'via':203C 'vulner':13A,118C,187C,224C,264C,306C,348C 'waf':87C,103C 'warmer':139C,230C,461C","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-06-09","covers":"HTTP request bodies and URIs proxied through Cloudflare, matched by the Managed Ruleset 'Drupal - PostgreSQL SQLi - CVE-2026-9082' rules (Body and URI)","limits":"Traffic not proxied through Cloudflare; the rule is a Block only for the matched signatures; non-HTTP paths not stated","source":"https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T18:56:00Z","confidence":0.9,"source_title":"WAF Release - 2026-06-09 · Changelog","customer_action":"patch Drupal; the WAF rule is an edge detection, not a fix for the vulnerable software"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-20T20:16:41+00:00","kev":{"dateAdded":"2026-05-22","dueDate":"2026-05-27","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"mlhess@drupal.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-9082","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9082","severity":null,"published_at":"2026-05-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9082","severity":null,"published_at":"2026-05-20T20:16:41+00:00","modified_at":"2026-10-07T19:17:45+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/#CVE-2026-9082","url":"https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/","severity":null,"published_at":"2026-06-09T18:55:57+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"Cloudflare: WAF Release - 2026-06-09 · Changelog"}],"documents":[{"id":2904,"url":"https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/","title":"Cloudflare: WAF Release - 2026-06-09 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-06-09 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJune 9, 2026\n\n## WAF Release - 2026-06-09\n\nThis release introduces new detections for a critical SQL injection vulnerability in Drupal installations utilizing PostgreSQL (CVE-2026-9082), alongside targeted protection for an unsafe deserialization flaw in the Mirasvit Cache Warmer extension (CVE-2026-45247). Additionally, this release includes coverage for a prototype pollution vector in Axios (CVE-2026-40175) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic.\n\nKey Findings\n\n- CVE-2026-9082: A database abstraction vulnerability affects Drupal sites configured with a PostgreSQL backend. Remote, unauthenticated attackers can exploit this flaw via crafted inputs to inject malicious SQL commands and access or manipulate backend data.\n- CVE-2026-45247: A PHP Object Injection vulnerability exists in the Mirasvit Cache Warmer extension for Magento and Adobe Commerce. This flaw stems from unsafe deserialization of untrusted user input, enabling unauthenticated attackers to execute arbitrary code on the hosting server.\n- CVE-2026-40175: A prototype pollution vulnerability affects the Axios HTTP client library. Attackers can exploit this to inject malicious properties into the global JavaScript object prototype, potentially causing application crashes (Denial of Service) or executing unauthorized code depending on the application structure.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate database contents, or induce application crashes, leading to severe operational disruption or complete server compromise. These newly deployed signatures intercept these advanced malicious payloads at the edge before they can interact with vulnerable software configurations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...387cf935 | N/A | Axios - Prototype Pollution - CVE:CVE-2026-40175 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...417eb9e0 | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - Body | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...fd3857fd | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...aee241d2 | N/A | SQLi - Obfuscated Boolean - Body | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d8620070 | N/A | SQLi - Obfuscated Boolean - Headers | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e0be4d47 | N/A | Mirasvit Cache Warmer - PHP Object Injection - CVE:CVE-2026-45247 | N/A | Block | This is a new detection. |","published_at":"2026-06-09T18:55:57+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}