Vulnerabilities/Drupal/CVE-2018-7600
CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownFix: Unknown
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 3 Nov 2021
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
Recommended action
Apply updates per vendor instructions.
CISA due date 3 May 2022 · CWE-20
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Unknown |
No source states a fixed version. Check the vendor advisory below.
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 3 Nov 2021 · Added to CISA KEV
- 3 May 2022 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.