Critical Drupal SQL Injection Flaw Added to CISA KEV List as Active Exploitation Spreads

CISA has ordered federal agencies to urgently patch a highly critical Drupal vulnerability that attackers are already exploiting in the wild.

CISA Issues Urgent Drupal Warning

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies about a critical Drupal vulnerability now under active exploitation.

The flaw, tracked as CVE-2026-9082, affects Drupal’s database abstraction API. Attackers can exploit the issue without authentication. The vulnerability mainly impacts Drupal sites running PostgreSQL databases.

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. The agency also ordered Federal Civilian Executive Branch agencies to patch affected systems before the official deadline.

Vulnerability Can Lead to Serious Attacks

Security researchers say attackers can use the flaw to launch SQL injection attacks through specially crafted requests.

Successful exploitation may allow threat actors to:

• Access sensitive information
• Escalate privileges
• Execute malicious code remotely
• Compromise backend databases

Google-owned Mandiant researcher Michael Maturi discovered the vulnerability. Meanwhile, the Drupal security team labeled the issue as “highly critical” after detecting exploitation attempts in the wild.

Large Organizations Face Higher Risk

Drupal remains widely used by governments, universities, media companies, and enterprise organizations. Many institutions rely on Drupal for large and complex web environments.

Because of this, attackers often focus on Drupal vulnerabilities. A successful compromise can expose sensitive records, internal systems, and critical services.

Threat monitoring group Shadowserver currently tracks hundreds of exposed Drupal servers that still remain unpatched online. Most vulnerable systems are located in North America and Europe.

Organizations Should Patch Immediately

Cybersecurity teams should apply available patches as soon as possible. Additionally, defenders should monitor for unusual database activity, suspicious login behavior, and unexpected privilege changes.

Security teams should also review externally exposed applications regularly. Fast patch management remains one of the most effective defenses against modern cyberattacks.

The incident highlights how attackers continue targeting internet-facing applications to gain initial access into enterprise networks. As a result, organizations across the UAE and GCC should prioritize vulnerability management and continuous monitoring for critical public-facing systems.