Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SQL injection vulnerability in Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog after confirming evidence of active exploitation in the wild.

The flaw, tracked as CVE-2026-9082 (CVSS score: 6.5), affects Drupal's widely deployed content management system. Its addition to the KEV catalog triggers mandatory remediation timelines for U.S. federal agencies and serves as a strong signal to private organizations to prioritize patching.

Vulnerability Details

SQL injection vulnerabilities allow attackers to manipulate database queries by injecting malicious SQL code through unsanitized user input. Depending on the implementation, successful exploitation can lead to:

• Authentication bypass — logging in without valid credentials
• Data exfiltration — reading sensitive database contents (user credentials, PII)
• Data manipulation — modifying or deleting database records
• In some cases, remote code execution — escalating to full server compromise

CISA KEV and What It Means

The CISA Known Exploited Vulnerabilities (KEV) catalog is a curated list of security flaws that have been confirmed as actively exploited by threat actors in real-world attacks. Addition to the KEV catalog carries significant weight:

For federal agencies: Under Binding Operational Directive (BOD) 22-01, all U.S. federal civilian executive branch (FCEB) agencies are required to remediate KEV vulnerabilities within CISA's specified timeframes — typically 2–4 weeks depending on severity.

For private sector: While not legally binding, CISA strongly recommends that all organizations treat KEV entries as high-priority. Vendors, critical infrastructure operators, and any organization running Drupal should patch immediately.

Drupal's Attack Surface

Drupal is one of the world's most widely used open-source content management systems, powering an estimated 2.3% of all websites globally. Its user base includes:

• Government agencies across North America, Europe, and Australia
• Universities and academic institutions
• Healthcare organizations
• Enterprise and Fortune 500 companies

This broad deployment, combined with Drupal's history of high-impact vulnerabilities (Drupalgeddon in 2014 and 2018 each triggered mass exploitation campaigns), makes CVE-2026-9082 a high-value target for opportunistic threat actors and sophisticated groups alike.

Historical Context: Drupalgeddon Pattern

Drupal has been targeted in mass exploitation campaigns before. When critical vulnerabilities were disclosed in 2014 (SA-CORE-2014-005) and 2018 (CVE-2018-7600), attackers began exploiting unpatched installations within hours of public disclosure — before most administrators could apply patches.

The current situation with CVE-2026-9082 follows a similar pattern:

1. Drupal patches released alongside public advisory
2. Technical details enabling exploitation quickly circulate
3. Automated scanning and exploitation begins
4. CISA confirms exploitation and adds to KEV
5. Organizations that haven't patched are now actively targeted

Remediation Actions

Organizations running Drupal must act immediately:

Immediate steps:

• Update Drupal Core to the latest patched release per the official Drupal security advisory at drupal.org/security
• If immediate patching is impossible, consider taking the site offline or restricting access temporarily
• Enable web application firewall (WAF) rules targeting SQL injection payloads

Post-patch verification:

• Review web server and database access logs for anomalous SQL patterns
• Look for signs of data exfiltration — unusual outbound connections or database query spikes
• Audit user accounts for unauthorized additions or privilege escalations
• Check for web shells or backdoors in the Drupal filesystem

Ongoing:

• Subscribe to Drupal security advisories at drupal.org/security
• Monitor CISA KEV for additional Drupal entries
• Implement database activity monitoring to detect injection attempts

Sources

• The Hacker News — Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

Related Reading

• Drupal: Critical SQL Injection Flaw Now Targeted in Attacks
• CISA Flags Apache ActiveMQ Flaw as Actively Exploited
• CISA Orders Feds to Patch Actively Exploited Citrix Flaw