CVE-2018-7600
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- Drupal Core Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 1 November 2026
- CWE
- CWE-20
Affected products
drupal: drupal; debian: debian linux
References
- https://groups.drupal.org/security/faq-2018-002 Vendor Advisory
- https://www.drupal.org/sa-core-2018-002 Vendor Advisory
- https://groups.drupal.org/security/faq-2018-002 Vendor Advisory
- https://www.drupal.org/sa-core-2018-002 Vendor Advisory
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE PatchThird Party Advisory
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE PatchThird Party Advisory
- https://research.checkpoint.com/uncovering-drupalgeddon-2/ ExploitThird Party Advisory
- https://www.exploit-db.com/exploits/44448/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44449/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44482/ ExploitThird Party AdvisoryVDB Entry