CVE-2018-7602 KEVRansomwarePublic exploit Critical · 9.8 EPSS 99.2%

Drupal Core Remote Code Execution Vulnerability

Summary

The flaw is a remote code execution vulnerability in multiple subsystems of Drupal core, affecting the 7.x and 8.x release lines. An attacker with network access and no authentication or user interaction could exploit one of several attack vectors against a Drupal site, potentially compromising it.

Official description · NVD

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

Breakdown

79.8 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules
What can follow
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource dataMedium confidence149 general detection rules

First seen exploited the day it was disclosed. Public exploit code (Exploit-DB) was available 3 months before disclosure.

Public exploit codeExploit-DB25 Apr 20183 mo before
DisclosedFirst seen exploitedVulnCheck KEV evidence19 Jul 2018day 0
Added to CISA KEVknown ransomware use; EU database agrees13 Apr 2022+4 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 11

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

MITRE CTID mapping of the CVE · uncategorised

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Code execution on web server achieved via exploit

could result in the site being compromised

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-7602 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: drupal/core.

Packagistdrupal/coreGHSA-297x-j9pm-xjgg DRUPAL-CORE-2018-004

Upgrade to 8.9.17

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2018-7600, CVE-2019-11358, +4).

Still affected on this line by CVE-2026-9082 (fixed in 10.4.10, a newer line).

Set the version to 8.9.17 or later in your composer.json.

First fixed in 8.5.3 for CVE-2018-7602.

Affected versions, by release line

If you run	Upgrade to
8.5 up to 8.5.3	8.9.17first fix for this CVE: 8.5.3
8.5.0 up to 8.5.3 Still affected on this line by CVE-2019-11358 (fixed in 8.5.15, a newer line); CVE-2019-6340 (fixed in 8.5.11, a newer line); CVE-2020-13671 (fixed in 8.8.11, a newer line); CVE-2020-28949 (fixed in 8.8.12, a newer line); CVE-2021-32610 (fixed in 8.9.17, a newer line).	8.5.3
8.0 up to 8.4.8 Still affected on this line by CVE-2019-11358 (fixed in 8.5.15, a newer line); CVE-2019-6340 (fixed in 8.5.11, a newer line); CVE-2020-13671 (fixed in 8.8.11, a newer line); CVE-2020-28949 (fixed in 8.8.12, a newer line); CVE-2021-32610 (fixed in 8.9.17, a newer line).	8.4.8
8.0.0 up to 8.4.8 Still affected on this line by CVE-2019-11358 (fixed in 8.5.15, a newer line); CVE-2019-6340 (fixed in 8.5.11, a newer line); CVE-2020-13671 (fixed in 8.8.11, a newer line); CVE-2020-28949 (fixed in 8.8.12, a newer line); CVE-2021-32610 (fixed in 8.9.17, a newer line).	8.4.8
7.0 up to 7.59	7.74first fix for this CVE: 7.59

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

Packagistdrupal/drupal
Affected: 8.5 up to 8.5.3; 8.0 up to 8.4.8; 7.0 up to 7.59Upgrade to 8.8.11 or later (older lines: 8.4.8, 7.74)
GHSA-297x-j9pm-xjgg

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

8 links, grouped by NVD tag (7 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 13 Apr 2022. Federal due date 4 May 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 13 Apr 2022. EUVD-2024-1058

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)EDB-44542 · webapps · php · 2018-04-25 · verified
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)EDB-44557 · webapps · php · 2018-04-30 · verified
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)EDB-44557 · webapps · php · 2018-04-30 · verified

, 30 Oct 2026

99.2%Top 0.07%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.93%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 3026 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9993 20.0/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 3 Exploit-DB entries; 2 advisory exploit references; 3 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total79.8

Record

Published: 19 Jul 2018
Modified: 2 Oct 2026
: CWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1What they do

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 6

What they do

What can follow

techniques