SQL injection Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003 issue
Yes, your site is vulnerable. If your network is stopping people accessing the Drupal site without prior authentication then you're (potentially) safe from those outside the network, but still vulnerable to those inside it.

As with all security issues, upgrade as soon as physically possible.