CVE-2018-7602

Drupal Core Remote Code Execution Vulnerability

IN CISA KEV

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

Vendor: Drupal
Product: Core
CVSS 3.1: 9.8 (critical), scored by NVD (primary)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 8.1 (high), scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-94
Published: 2018-07-19
NVD modified: 2026-10-02
NVD status: Analyzed

CISA KEV

Date added: 2022-04-13
Due date: 2022-05-04
Ransomware use: Known
Required action: Apply updates per vendor instructions.

EPSS

99.2% chance of exploitation in the next 30 days (percentile 99th)

FIRST EPSS, updated 17 Oct 2026. About EPSS

CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.

References

www.securityfocus.com (Broken Link, Third Party Advisory, VDB Entry)
www.securitytracker.com (Broken Link, Third Party Advisory, VDB Entry)
lists.debian.org (Mailing List, Third Party Advisory)
www.debian.org (Third Party Advisory)
www.drupal.org (Patch, Vendor Advisory)
www.securityfocus.com (Broken Link, Third Party Advisory, VDB Entry)
www.securitytracker.com (Broken Link, Third Party Advisory, VDB Entry)
lists.debian.org (Mailing List, Third Party Advisory)
www.debian.org (Third Party Advisory)
www.drupal.org (Patch, Vendor Advisory)
www.cisa.gov (US Government Resource)

Data last updated 18 Oct 2026. Sources: NVD API 2.0, CISA KEV catalog, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.