Drupal has published SA-CORE-2026-004, a highly critical Drupal core security advisory for a SQL injection vulnerability in Drupal core.

The vulnerability is tracked as CVE-2026-9082 and has been rated Highly critical, 20/25 by the Drupal Security Team. The primary issue affects Drupal sites using PostgreSQL databases. Drupal states that the vulnerability may be exploitable by anonymous users and could allow arbitrary SQL injection, potentially leading to information disclosure, privilege escalation, remote code execution, or other attacks.

Drupal has also included coordinated upstream dependency security updates for Symfony and Twig in the supported Drupal core releases. Because of those dependency updates, Drupal recommends updating even for sites that are not using PostgreSQL.

Reliable Penguin does not perform Drupal application updates. Drupal site owners and administrators should review their own Drupal installations, determine whether their sites are affected, and take appropriate action based on Drupal’s official advisory.

Affected Drupal versions include Drupal core versions from 8.9.0 through versions before 10.4.10, 10.5.x before 10.5.10, 10.6.x before 10.6.9, 11.0.x before 11.1.10, 11.2.x before 11.2.12, and 11.3.x before 11.3.10. Drupal recommends updating to the latest available release for your supported branch.

Site owners should apply updates promptly and review which user roles have permission to update Twig templates, such as through Views or contributed modules.

Read the official Drupal security advisory:
https://www.drupal.org/sa-core-2026-004

For urgent questions, please contact Reliable Penguin support.