CVE-2026-9082: Drupal core SQL injection actively exploited - 15000+ attacks on 6000 sites in 65 countries within 48h of patch

Drupal released a highly critical patch on May 20 for an unauthenticated SQL injection in its core database abstraction API affecting PostgreSQL backends. Imperva reports over 15,000 attack attempts on nearly 6,000 sites across 65 countries within 48 hours, with nearly half targeting gaming and financial services. CISA added the flaw to its Known Exploited Vulnerabilities catalog and federal agencies have two weeks to patch. Sources: Drupal.org, Tenable, Imperva, SecurityWeek, The Hacker News, SecurityAffairs, CISA KEV.