CISA orders feds to patch actively exploited Drupal vulnerability
CISA added a critical Drupal SQL injection flaw to its exploited-vulnerabilities list and gave federal agencies until Wednesday to patch it.
Intelligence analysis by GPT-5.4 Mini
CISA has ordered U.S. civilian federal agencies to fix CVE-2026-9082 by May 27 after confirming it is being exploited in the wild. The flaw affects Drupal’s database abstraction layer and could expose data, raise privileges, or lead to remote code execution.
A popular website tool called Drupal has a hole that bad actors can use without logging in. It is a bit like a door that can be opened by pushing the right hidden button from outside.
CISA, the U.S. government cyber group, told federal offices to fix it fast because attackers are already trying it in the real world. That means it is not just a warning for later; it is a problem right now.
The article says the hole could let attackers see private data, get more power inside a site, or even take over parts of it. That is why defenders are being told to patch it quickly, like fixing a broken lock before anyone slips in.
Analysis
What happened
CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalog and told Federal Civilian Executive Branch agencies to patch by midnight on Wednesday, May 27 under Binding Operational Directive 22-01. The issue is an SQL injection flaw in Drupal’s database abstraction API that can be triggered without authentication.
Why it is serious
According to the article, specially crafted requests can abuse PostgreSQL-backed Drupal sites. If an attacker succeeds, the impact can go beyond data leakage and reach privilege escalation, with remote code execution also described as a possible outcome. The Drupal security team marked the flaw as highly critical before fixes were released and said exploitation attempts had already been seen.
Evidence of active abuse
The story cites Google/Mandiant researcher Michael Maturi as the discoverer of the flaw. It also quotes Imperva saying it had seen more than 15,000 attack attempts against nearly 6,000 sites in 65 countries since disclosure, with gaming and financial services accounting for about half of the observed attacks. Shadowserver is said to be tracking nearly 670 unpatched Drupal installations exposed online, with most located in North America and Europe.
Broader takeaway
Although the directive only binds federal civilian agencies, CISA explicitly urged all organizations to patch as soon as possible. The agency also noted that it has flagged five Drupal vulnerabilities exploited in the wild over the past several years, and two were later used in ransomware attacks. The message is straightforward: if a flaw is in the KEV catalog, it belongs at the top of the remediation queue.
Key points
- CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalog.
- Federal civilian agencies must patch by midnight on Wednesday, May 27, 2026.
- The Drupal flaw allows unauthenticated SQL injection on PostgreSQL-powered sites.
- Imperva said it observed more than 15,000 attack attempts across nearly 6,000 sites.
- Shadowserver is tracking nearly 670 exposed unpatched Drupal installations.
