CVE-2018-7600 KEVRansomwarePublic exploit Critical · 9.8 EPSS >99.9%

Drupal Core Remote Code Execution Vulnerability

Drupal · Drupal Core

Summary

Drupal Core contains a flaw in multiple subsystems affecting versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1, classed as improper input validation. A remote attacker with no authentication or user interaction can execute arbitrary code on the affected site when default or common module configurations are in use.

Official description · NVD

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Breakdown

83.7 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource dataMedium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource dataMedium confidence95 general detection rules
What can follow
- Delete or destroy dataT1485 · Data DestructionSource dataMedium confidence20 general detection rules
- Use the system to mine cryptocurrencyT1496 · Resource HijackingSource dataMedium confidence13 general detection rules

First seen exploited 22 days after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.

Public exploit codeMetasploit28 Mar 20181 day before
Disclosed29 Mar 2018day 0
First seen exploitedVulnCheck KEV evidence20 Apr 2018+22 days
Named in a threat reportblog.talosintelligence.com17 Apr 2019+13 mo
Added to CISA KEVknown ransomware use; EU database agrees3 Nov 2021+4 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

4 , grouped by in kill-chain order 4

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

MITRE CTID mapping of the KEV entry · how it is exploited

CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

MITRE CTID mapping of the KEV entry · primary impact

ImpactTA0040

Data Destruction T1485 Medium

MITRE CTID mapping of the KEV entry · follow-on activity

Resource Hijacking T1496 Medium

MITRE CTID mapping of the KEV entry · follow-on activity

Detection

0 rules for this CVE · 277 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-7600 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Data DestructionT148520 general rules

Fsutil Suspicious Invocationhighstable
Potential BlackByte Ransomware Activityhightest
Potential File Overwrite Via Sysinternals SDeletehightest
Renamed Sysinternals Sdelete Executionhightest
AWS EFS Fileshare Mount Modified or Deletedmediumtest
Azure Device or Configuration Modified or Deletedmediumtest
Azure Kubernetes Network Policy Changemediumtest
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest

All 20 on SigmaHQ ↗

Resource HijackingT149613 general rules

Linux Crypto Mining Pool Connectionshighstable
Monero Crypto Coin Mining Pool Lookuphighstable
Network Communication With Crypto Mining Poolhighstable
Potential Crypto Mining Activityhighstable
Linux Crypto Mining Indicatorshightest
Azure Kubernetes Network Policy Changemediumtest
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest
Azure Kubernetes Secret or Config Object Accessmediumtest

All 13 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: drupal/core.

Packagistdrupal/coreGHSA-7fh9-933g-885p DRUPAL-CORE-2018-002

Upgrade to 8.9.17

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2018-7602, CVE-2019-11358, +4).

Still affected on this line by CVE-2026-9082 (fixed in 10.4.10, a newer line).

Set the version to 8.9.17 or later in your composer.json.

First fixed in 8.5.1 for CVE-2018-7600.

Affected versions, by release line

If you run	Upgrade to
8.5.0 up to 8.5.1	8.9.17first fix for this CVE: 8.5.1
8.4.0 up to 8.4.6 Still affected on this line by CVE-2019-11358 (fixed in 8.5.15, a newer line); CVE-2019-6340 (fixed in 8.5.11, a newer line); CVE-2020-13671 (fixed in 8.8.11, a newer line); CVE-2020-28949 (fixed in 8.8.12, a newer line); CVE-2021-32610 (fixed in 8.9.17, a newer line).	8.4.8first fix for this CVE: 8.4.6
8.0 up to 8.3.9 Still affected on this line by CVE-2018-7602 (fixed in 8.4.8, a newer line); CVE-2019-11358 (fixed in 8.5.15, a newer line); CVE-2019-6340 (fixed in 8.5.11, a newer line); CVE-2020-13671 (fixed in 8.8.11, a newer line); CVE-2020-28949 (fixed in 8.8.12, a newer line); CVE-2021-32610 (fixed in 8.9.17, a newer line).	8.3.9
8.0.0 up to 8.3.9 Still affected on this line by CVE-2018-7602 (fixed in 8.4.8, a newer line); CVE-2019-11358 (fixed in 8.5.15, a newer line); CVE-2019-6340 (fixed in 8.5.11, a newer line); CVE-2020-13671 (fixed in 8.8.11, a newer line); CVE-2020-28949 (fixed in 8.8.12, a newer line); CVE-2021-32610 (fixed in 8.9.17, a newer line).	8.3.9
7.0 up to 7.58	7.74first fix for this CVE: 7.58

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

Packagistdrupal/drupal
Affected: 8.5 up to 8.5.1; 8.4 up to 8.4.6; 8.0 up to 8.3.9; 7.0 up to 7.58Upgrade to 8.8.11 or later (older lines: 8.4.8, 8.3.9, 7.74)
GHSA-7fh9-933g-885p

Check your lockfile against all CVEs

What security researchers reported

Named in 1 threat report

1 reportCisco TalosApr 2019

Reports are matched by finding the exact id CVE-2018-7600 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Cisco Talos17 Apr 2019

DNS Hijacking Abuses Trust In Core Internet Service

Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security Appliances (ASAs) and FirewallsSID: 46897CVE-2018-7600: RCE for Website built with Drupal aka "Drupalgeddon"SID:

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

21 links, grouped by NVD tag (20 duplicates merged)

Show 9 moreShow fewer

twitter.com/RicterZ/status/979567469726613504 twitter.com/RicterZ/status/984495201354854401 twitter.com/arancaytar/status/979090719003627521 debian.org/security/2018/dsa-4156 exploit-db.com/exploits/44448/exploit-db.com/exploits/44449/exploit-db.com/exploits/44482/synology.com/support/security/Synology_SA_18_17 tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2022-2985

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)EDB-44448 · webapps · php · 2018-04-13 · verified
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code ExecutionEDB-44449 · webapps · php · 2018-04-13 · verified
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)EDB-44482 · remote · php · 2018-04-17 · verified
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)EDB-44482 · remote · php · 2018-04-17 · verified

, 30 Oct 2026

>99.9%Top 0.01%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.98%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 3116 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9999 20.0/20

Threat reports1 report 3.9/10

Public exploit code4 NVD references tagged Exploit; 4 Exploit-DB entries; 3 advisory exploit references; 47 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total83.7

Record

Published: 29 Mar 2018
Modified: 17 Jun 2026
: CWE-20 Improper Input Validation
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

3What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

DNS Hijacking Abuses Trust In Core Internet Service

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 2

Patch 1

US Government Resource 1

Third Party Advisory 17

How attackers get in

What they do

What can follow

techniques