CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Published Jul 19, 2018 · updated Oct 2, 2026 · drupal drupal
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
Timeline
Detection, updates, and resolution for this record.
Jul 19, 2018 · Catalog
Detected
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploi
Apr 13, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 4, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Oct 2, 2026 · Catalog
Updated
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploi
Required action
Apply updates per vendor instructions.
CISA due date May 4, 2022
Affected
- cpe debian/debian linux7.0
- cpe debian/debian linux8.0
- cpe debian/debian linux9.0
- cpe drupal/drupalversion unspecified
- vendor Drupal Coreversion unspecified
Sources
- CISA KEVCVE-2018-7602
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
cisa.gov - CVE.orgCVE-2018-7602
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-7602
30-day exploitation probability 99.2%
first.org - Exploit Database44542
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database44557
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2018-7602
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - H
nvd.nist.gov