The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Drupal Core SQL injection vulnerability to its Known Exploited Vulnerabilities catalog following confirmation that threat actors are actively exploiting the flaw. The designation triggers a binding 14-day remediation deadline for U.S. federal agencies and signals an urgent priority for all organizations running the widely deployed content management system.
The vulnerability, tracked as CVE-2026-9082, carries a CVSS severity score of 6.5 and affects all supported versions of Drupal Core. While the numerical rating places it in the medium range, verified in-the-wild exploitation elevates the operational threat well beyond what the score suggests. CISA's KEV listing makes clear that active exploitation should take precedence over CVSS numbers when prioritizing remediation.
Drupal powers thousands of public-facing websites across government, education, and enterprise sectors. For IT administrators managing Drupal-based portals, intranets, or customer-facing applications, the KEV designation confirms that theoretical risk has become active threat. Organizations should treat this vulnerability as a critical remediation target regardless of the moderate severity rating.
The Drupal security team has released a patch addressing the SQL injection flaw. Security teams should apply the update immediately. Where change-control policies or legacy dependencies prevent instant patching, compensating controls can bridge the gap: enforce strict input sanitization at the web application firewall, isolate database endpoints from public networks, and monitor query traffic for anomalous patterns indicative of exploitation attempts.
CISA has not yet published detailed attack vectors or specific indicators of compromise for CVE-2026-9082. Security teams should monitor official Drupal advisories and CISA bulletins for updated forensic guidance. Organizations with heavily customized installations should test patches in isolated staging environments before production rollout, as compatibility issues with third-party modules can complicate rapid remediation.
The rapid transition from disclosure to active exploitation reflects a broader trend: the window between vulnerability publication and weaponization continues to shrink. For widely deployed platforms like Drupal, automated patch management and continuous dependency tracking are now baseline requirements, not optional practices.
The KEV catalog has proven effective at cutting through vulnerability noise. By listing only flaws with confirmed exploitation, CISA enables security teams to allocate limited resources toward the threats that matter most. CVE-2026-9082's addition reinforces that principle.
Organizations running Drupal Core should inventory all instances, apply the May 2026 security update, and verify successful deployment across their infrastructure. Delaying remediation increases exposure as exploit techniques mature and circulate.
美國網絡安全及基礎設施安全局（CISA）已將 Drupal Core 的 SQL injection 漏洞列入其已知被利用漏洞（Known Exploited Vulnerabilities）目錄，因確認有威脅行為者正活躍利用此漏洞。此指定為美國聯邦機構觸發具約束力的 14 天修復期限，並向所有運行這廣泛部署的內容管理系統的機構發出緊急優先處理訊號。
此漏洞編號為 CVE-2026-9082，CVSS 嚴重程度評分為 6.5，影響所有受支援版本的 Drupal Core。雖然數值評級屬中等範圍，但經核實的 in-the-wild 利用已將實際威脅提升至遠超評分所顯示的水平。CISA 的 KEV 清單清楚表明，在優先處理修復工作時，活躍利用應優先於 CVSS 數值。
Drupal 為政府、教育及企業界別數千個面向公眾的網站提供支援。對於管理 Drupal 入口網站、intranet 或面向客戶應用程式的 IT 管理員而言，KEV 指定確認理論風險已轉化為活躍威脅。無論嚴重程度評級如何，各機構應將此漏洞視為關鍵修復目標。
Drupal 安全團隊已發布修補程式以解決此 SQL injection 漏洞，安全團隊應立即應用更新。若 change-control 政策或舊有依賴關係阻礙即時修補，可採用補償性控制措施填補空缺：在 web application firewall 實施嚴格的輸入清理、將數據庫端點與公共網絡隔離，以及監控查詢流量以識別可能表明利用嘗試的異常模式。
CISA 尚未公布 CVE-2026-9082 的詳細攻擊向量或具體 indicators of compromise。安全團隊應監察 Drupal 官方公告及 CISA 公報以獲取最新法證指引。擁有高度自訂安裝的機構應在隔離的 staging 環境中測試修補程式，然後才在 production 部署，因為與第三方模組的兼容性問題可能使快速修復複雜化。
從披露到活躍利用的快速轉變反映了一個更廣泛的趨勢：漏洞公布與武器化之間的時間窗口持續縮短。對於 Drupal 等廣泛部署的平台，自動化 patch management 及持續的依賴關係追蹤現已成為基本需求，而非可選做法。
KEV 目錄已證明能有效過濾漏洞噪音。透過僅列出經確認被利用的漏洞，CISA 使安全團隊能夠將有限資源分配至最重要的威脅。CVE-2026-9082 的加入強化了這一原則。
運行 Drupal Core 的機構應清查所有實例、應用 2026 年 5 月安全更新，並驗證其在基礎設施中的成功部署。延遲修復會增加暴露風險，因為利用技術不斷成熟及傳播。