CISA orders feds to patch actively exploited Drupal vulnerability
Source: Bleeping Computer
Overview
The Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. government agencies until Wednesday evening to secure their servers against an actively exploited SQL injection vulnerability in the Drupal content management system (CMS).
Vulnerability Details
- CVE Identifier: CVE‑2026‑9082
- Discovered by: Google/Mandiant researcher Michael Maturi
- Affected component: Drupal’s database abstraction API
- Impact: Unauthenticated attackers can trigger arbitrary SQL injection on PostgreSQL‑powered sites, potentially leading to information disclosure, privilege escalation, and remote code execution.
The Drupal security team classified the flaw as highly critical before releasing patches and confirmed that exploitation attempts had already been observed in the wild.
CISA Action
- The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog.
- Federal Civilian Executive Branch (FCEB) agencies are required to apply the patches by midnight on Wednesday, May 27, as mandated by Binding Operational Directive (BOD) 22‑01.
- Although BOD 22‑01 applies only to federal agencies, CISA urges all organizations—including private‑sector entities—to remediate the vulnerability promptly.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise … CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice,” the agency warned.
Exposure Statistics
Internet security watchdog Shadowserver is tracking nearly 670 unpatched Drupal installations exposed online, with the majority located in:
- North America: 272
- Europe: 273
Unpatched Drupal instances (Shadowserver)
Historical Context
Over the past several years, CISA has flagged five Drupal vulnerabilities that have been exploited in the wild, two of which were also leveraged in ransomware attacks.