CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Published Mar 29, 2018 · updated Jun 16, 2026 · drupal drupal
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 29, 2018 · Catalog
Detected
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe debian/debian linux7.0
- cpe debian/debian linux8.0
- cpe debian/debian linux9.0
- cpe drupal/drupalversion unspecified
- vendor Drupal Drupal Coreversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2018-7600
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
cisa.gov - CVE.orgVulnerability recordCVE-2018-7600
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2018-7600
30-day exploitation probability 100.0%
first.org - Exploit DatabasePublic exploit reference44449
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference44482
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_unix/webapp/drupal_drupalgeddon2
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
nvd.nist.gov