LmCast :: Stay tuned in

CISA orders feds to patch actively exploited Drupal vulnerability

Recorded: May 26, 2026, 1:16 p.m.

Original Summarized

CISA orders feds to patch actively exploited Drupal vulnerability

News

Featured
Latest

Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

Laravel Lang packages hijacked to deploy credential-stealing malware

Netherlands seizes 800 servers of hosting firm enabling cyberattacks

Ubiquiti patches three max severity UniFi OS vulnerabilities

Microsoft Defender can now automatically isolate hacked endpoints

Webinar: Too many tools are slowing network incident response

This lifetime PDF editor is just $65 with code SAVE5 through 5/31

CISA orders feds to patch actively exploited Drupal vulnerability

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityCISA orders feds to patch actively exploited Drupal vulnerability

CISA orders feds to patch actively exploited Drupal vulnerability

By Sergiu Gatlan

May 26, 2026
04:46 AM
0

CISA has given U.S. government agencies until Wednesday evening to secure their servers against an SQL injection vulnerability in the Drupal content management system (CMS) that it flagged as actively exploited.
Drupal is typically used by large organizations managing massive data structures and multi-site installations, including government entities, educational organizations, major research universities, and high-profile enterprise and media organizations.
Google/Mandiant researcher Michael Maturi discovered this vulnerability (now tracked as CVE-2026-9082) in Drupal's database abstraction API.
The security flaw can be exploited without authentication, allowing attackers to trigger arbitrary SQL injection on PostgreSQL-powered sites via specially crafted requests. Successful exploitation can potentially lead to information disclosure, privilege escalation, and even remote code execution.
The Drupal security team tagged the flaw as "highly critical" before releasing patches and confirming that exploitation attempts had been detected in the wild.
"Since CVE-2026-9082 was released, Imperva has observed over 15,000 attack attempts targeting almost 6,000 individual sites across 65 countries," cybersecurity firm Imperva warned on May 21. "Attacks are primarily targeting Gaming and Financial Services sites so far, at collectively almost 50% of all attacks."
Internet security watchdog group Shadowserver now tracks nearly 670 unpatched Drupal installations exposed online, most of them from North America (272) and Europe (273).

Unpatched Drupal instances (Shadowserver)
​On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to patch their systems by midnight on Wednesday, May 27, as mandated by Binding Operational Directive (BOD) 22-01.
Although BOD 22-01 applies only to U.S. federal agencies, CISA advised all defenders, including those in the private sector, to apply CVE-2026-9082 patches as soon as possible to secure their organizations' devices.
"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise [..] Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice," the cybersecurity agency warned.
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
Over the last several years, CISA has flagged 5 Drupal vulnerabilities that have been exploited in the wild, two of which have also been abused in ransomware attacks.

The Validation Gap: Automated Pentesting Answers One Question. You Need Six.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate.
Download Now

Related Articles:
Drupal: Critical SQL injection flaw now targeted in attacksMicrosoft warns of new Defender zero-days exploited in attacksGhost CMS SQL injection flaw exploited in large-scale ClickFix campaignTrend Micro warns of Apex One zero-day exploited in the wildCISA gives feds four days to patch Ivanti flaw exploited as zero-day

Actively Exploited
CISA
Drupal
PostgreSQL
Shadowserver
SQL Injection

Sergiu Gatlan
Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

  Upcoming Webinar

Popular Stories

Laravel Lang packages hijacked to deploy credential-stealing malware

Italy disrupts CINEMAGOAL piracy app that stole streaming auth codes

Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

Sponsor Posts

Overdue a password health-check? Audit your Active Directory for free

33% Rise in Healthcare Credential Theft in 2025: What you need to know

Patch management isn't enough. See why privilege is defining security risk today.

Protect Your Business from Ecommerce Fraud

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

The Cybersecurity and Infrastructure Security Agency (CISA) mandated that U.S. government agencies secure their systems against an actively exploited SQL injection vulnerability within the Drupal content management system (CMS). This directive required Federal Civilian Executive Branch (FCEB) agencies to patch their affected systems by midnight on Wednesday, May 27, pursuant to Binding Operational Directive (BOD) 22-01. This vulnerability, tracked as CVE-2026-9082, was discovered by Google/Mandiant researcher Michael Maturi in Drupal's database abstraction API.

The security flaw allows attackers to execute arbitrary SQL injection on sites powered by PostgreSQL through specially crafted requests, even without prior authentication. Successfully exploiting this vulnerability carries severe potential consequences, including information disclosure, privilege escalation, and remote code execution. The Drupal security team had classified this flaw as "highly critical" prior to releasing patches, confirming that exploitation attempts had already been observed in the wild.

The scale of the threat has been significant; cybersecurity firm Imperva reported observing over 15,000 attack attempts targeting almost 6,000 individual sites across 65 countries since the release of the vulnerability. These attacks have disproportionately targeted Gaming and Financial Services sites, accounting for nearly fifty percent of all observed attacks. Furthermore, the Internet security watchdog group Shadowserver monitors nearly 670 unpatched Drupal installations exposed online, most of which are located in North America and Europe. Historically, CISA has previously flagged five Drupal vulnerabilities that were exploited in the wild, two of which were also leveraged in ransomware attacks.

In response to this threat, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. Beyond the federal mandate, CISA strongly urged all organizations, including the private sector, to prioritize the timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practices to reduce exposure to cyberattacks. The agency advised organizations to apply vendor-specific mitigations, adhere to applicable BOD 22-01 guidance for cloud services, or discontinue the use of the affected product if appropriate mitigations cannot be implemented.