CISA orders feds to patch actively exploited Drupal vulnerability
Source Bleeping Computer
Mentioned vulnerabilities
Rated High by Threat Radar from the Bleeping Computer text
Data as of 27 May 2026, 22:04 UTC
What to do
AI-suggested
Patches for CVE-2026-9082 have been released by the Drupal security team and should be applied immediately. CISA has mandated U.S. federal agencies to patch by May 27, 2026, under Binding Operational Directive 22-01. Organizations outside the federal government are strongly urged to apply the patches promptly to reduce exposure. If patches cannot be applied, follow any vendor-provided mitigations or consider discontinuing use of affected Drupal versions. Monitoring vendor advisories for updates is recommended. No indication of 'no action required' or pre-mitigation status was provided.
Description
CISA has given U.S.government agencies until Wednesday evening to secure their servers against an SQL injection vulnerability in the Drupal content management system (CMS) that it flagged as actively exploited. [...]