SQL injection Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003 issue I got this news today about  SA-CORE-2014-005 - Drupal core - SQL injection. 

We are not using drupal in build authentication. We have a custom authentication, which resides behind SSO and gateway. A user can only get access or even get access page if the user is the in SSO and Gateway servers.

Is this kind of setting also vulnerable to this attack, as access is not handled by drupal?
Yes, your site is vulnerable. If your network is stopping people accessing the Drupal site without prior authentication then you're (potentially) safe from those outside the network, but still vulnerable to those inside it.

As with all security issues, upgrade as soon as physically possible.