Threats

CISA orders feds to patch actively exploited Drupal vulnerability

CISA has issued an emergency directive requiring all U.S. federal agencies to patch an actively exploited SQL injection vulnerability in the Drupal content management system. The flaw, tracked as CVE-2026-9082, has been added to CISA's Known Exploited Vulnerabilities catalog, signaling confirmed in-the-wild exploitation. Agencies have until Wednesday evening to apply the fix, reflecting the urgency of the threat given Drupal's widespread use in government web infrastructure. The vulnerability enables unauthenticated attackers to execute arbitrary SQL queries against backend databases, potentially exposing sensitive data or enabling further compromise. This directive follows a pattern of CISA accelerating patch timelines as threat actors increasingly weaponize newly disclosed vulnerabilities within hours of publication.

View on Graph

Overview

  • CISA has issued an emergency directive requiring all U.S.
  • federal agencies to patch an actively exploited SQL injection vulnerability in the Drupal content management system.
  • The flaw, tracked as CVE-2026-9082, has been added to CISA’s Known Exploited Vulnerabilities catalog, signaling confirmed in-the-wild exploitation.
  • Agencies have until Wednesday evening to apply the fix, reflecting the urgency of the threat given Drupal’s widespread use in government web infrastructure.
  • The vulnerability enables unauthenticated attackers to execute arbitrary SQL queries against backend databases, potentially exposing sensitive data or enabling further compromise.
  • This directive follows a pattern of CISA accelerating patch timelines as threat actors increasingly weaponize newly disclosed vulnerabilities within hours of publication.

Sources