The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Drupal Core vulnerability to its Known Exploited Vulnerabilities catalog, confirming that the flaw is being actively exploited. The listing for CVE-2026-9082, which carries a CVSS score of 9.8, requires organizations running Drupal infrastructure to treat patching as an incident response priority rather than routine maintenance.
Drupal issued a security patch in May 2026, but the gap between patch availability and deployment has left systems exposed. The KEV catalog designation confirms threat actors are leveraging the flaw in the wild, narrowing the window for proactive defense.
For organizations relying on Drupal, the KEV listing provides a clear prioritization signal. Security teams face hundreds of newly disclosed CVEs each month. The catalog isolates only vulnerabilities with confirmed real-world exploitation, enabling teams to focus limited remediation resources on verified threats.
Federal agencies and government contractors must meet CISA's mandated remediation deadlines under binding operational directives. Private sector operators face no regulatory requirement, but the technical risk is identical: unpatched Drupal deployments are already being targeted.
The incident underscores a persistent bottleneck in open-source security. The constraint is not patch quality but deployment speed. Organizations without automated update processes or staging validation workflows remain exposed, as fixes only provide protection once they reach production systems.
Security teams should take three immediate actions. First, conduct a comprehensive asset inventory to locate all Drupal deployments, including legacy systems and third-party-managed installations. Second, temporarily isolate unpatched systems from public-facing networks. Third, integrate automated KEV feed monitoring into existing vulnerability management pipelines to ensure future exploited threats are flagged without manual intervention.
CVE-2026-9082's addition to the KEV catalog reinforces that open-source security is a shared responsibility. Patches only protect systems when organizations deploy them with urgency matching the threat.
美國網絡安全及基礎設施安全局已將一項嚴重的 Drupal Core 漏洞列入已知遭利用漏洞目錄，確認該缺陷正遭主動利用。CVE-2026-9082 的 CVSS 評分為 9.8，是次列名要求使用 Drupal 基礎設施的機構必須將修補工作列為事故應變的優先事項，而非日常維護。
Drupal 已於 2026 年 5 月發布安全修補程式，但修補程式推出與部署之間的落差，令系統仍處於暴露狀態。KEV 目錄的指定確認威脅行為者已在真實環境中利用該缺陷，收窄了主動防禦的時間窗口。
對於依賴 Drupal 的機構而言，KEV 列名提供了明確的優先處理指引。保安團隊每月面對數百個新披露的 CVE。該目錄僅篩選已確認在真實環境中遭利用的漏洞，使團隊能將有限的修補資源集中於已驗證的威脅。
聯邦機構及政府承辦商必須根據具約束力的營運指令，符合 CISA 規定的修補期限。私營機構營運者雖無此監管要求，但技術風險完全相同：未修補的 Drupal 系統已成為攻擊目標。
是次事件突顯開源保安中持續存在的瓶頸。關鍵制約並非修補程式的質素，而是部署速度。缺乏自動更新流程或 staging 驗證工作流程的機構，仍面臨暴露風險，因為修補只有在部署至生產系統後方能提供保護。
保安團隊應採取三項即時行動。第一，進行全面的資產盤點，定位所有 Drupal 部署，包括舊有系統及由第三方管理的安裝。第二，暫時將未修補的系統與對外網絡隔離。第三，將自動化的 KEV feed 監控整合至現有的漏洞管理 pipeline，確保未來遭主動利用的威脅能在無需人手干預的情況下被標記。
CVE-2026-9082 加入 KEV 目錄進一步確認，開源保安屬共同責任。修補程式只有在機構以配合威脅的緊急性進行部署時，方能發揮保護作用。