Drupal has patched CVE-2026-9082, a highly critical vulnerability that could allow threat actors to hack websites.