CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Published Mar 29, 2018 · updated Jun 16, 2026 · drupal drupal
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Timeline
Detection, updates, and resolution for this record.
Mar 29, 2018 · Catalog
Detected
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe debian/debian linux7.0
- cpe debian/debian linux8.0
- cpe debian/debian linux9.0
- cpe drupal/drupalversion unspecified
- vendor Drupal Drupal Coreversion unspecified
Sources
- CISA KEVCVE-2018-7600
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
cisa.gov - CVE.orgCVE-2018-7600
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-7600
30-day exploitation probability 100.0%
first.org - Exploit Database44449
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database44482
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_unix/webapp/drupal_drupalgeddon2
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
nvd.nist.gov