Critical Drupal SQL Injection Flaw Under Active Exploitation, CISA Issues Emergency Directive The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive requiring federal agencies to patch a severe SQL injection vulnerability in Drupal’s content management system (CMS) by Wednesday, May 27, at midnight. The flaw, tracked as CVE-2026-9082, was discovered by Google/Mandiant researcher Michael Maturi and is actively being exploited in the wild. The vulnerability resides in Drupal’s database abstraction API and allows unauthenticated attackers to execute arbitrary SQL injection on PostgreSQL-powered sites through malicious requests. Successful exploitation could lead to information disclosure, privilege escalation, or remote code execution, posing a major risk to affected systems. Drupal’s security team classified the flaw as "highly critical" before releasing patches, confirming that exploitation attempts had already been detected. Security monitoring group Shadowserver has identified 670 unpatched Drupal installations exposed online, with the majority located in North America (272) and Europe (273). CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on Friday, mandating Federal Civilian Executive Branch (FCEB) agencies to remediate the issue under Binding Operational Directive (BOD) 22-01. While the directive applies only to federal agencies, CISA has urged all organizations, including private sector entities, to prioritize patching to mitigate risks. The agency emphasized that such vulnerabilities are frequent attack vectors for malicious actors and pose significant threats to enterprise security. Drupal is widely used by government agencies, educational institutions, research universities, and large enterprises, making this flaw particularly concerning. Over the past several years, CISA has flagged five Drupal vulnerabilities exploited in the wild, with two linked to ransomware attacks. Organizations are advised to apply vendor-provided patches or discontinue use of unpatched systems if mitigations are unavailable.