Vendor

Drupal

5 of 9 Drupal CVEs in Patchfirst (56%) are in of vulnerabilities exploited in the wild, 2 of them used by ransomware.

CVEs: 9
In CISA KEV: 556%
Known ransomware use: 2
Median days to KEV: 1,128; from publication
Latest KEV listing: 22 May 2026

Watch Drupal Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Core In KEV: 3 CVEs: 3
Drupal Core In KEV: 1 CVEs: 2
Drupal core In KEV: 1 CVEs: 1
Block AJAX In KEV: 0 CVEs: 1
Commerce Core In KEV: 0 CVEs: 1
Webform In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Drupal CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 5
T1059Command and Scripting Interpreter CVEs: 5
T1485Data Destruction CVEs: 1
T1496Resource Hijacking CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/drupal.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Drupal CVEs linked to the technique. Each link’s provenance is on the CVE page.

Drupal CVEs

9 CVEs, by priority

CVE-2018-7600Drupal Core Remote Code Execution Vulnerability
Drupal · Drupal CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more · 1 report
>99.9%Top 0.01%
83.7priority
CVE-2018-7602Drupal Core Remote Code Execution Vulnerability
Drupal · CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
99.2%Top 0.07%
79.8priority
CVE-2020-13671Drupal core Un-restricted Upload of File
Drupal · Drupal coreKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
36.2%Top 1.5%
78.9priority
CVE-2026-9082Drupal Core SQL Injection Vulnerability
Drupal · CoreKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
89.4%Top 0.22%
74.8priority
CVE-2019-6340Drupal Core Remote Code Execution Vulnerability
Drupal · CoreKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
92.0%Top 0.18%
68.6priority
CVE-2026-118539Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing
Drupal · Commerce CoreMedium · 6.5
0.3%Top 77%
54.9priority
CVE-2017-6922Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
Drupal · Drupal Core
1.9%Top 20%
51.0priority
CVE-2026-96355Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code…
Drupal · WebformCritical · 9.1
0.4%Top 64%
15.6priority
CVE-2026-107249Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…
Drupal · Block AJAXCritical · 9.8
0.4%Top 66%
14.3priority