Live › vulnerability › CVE-2018-7602
Go to dashboardDrupal core has a remote code execution flaw in multiple subsystems that lets an attacker run code on a Drupal site through several attack paths. It is listed as actively exploited in the wild and is tagged as used in ransomware.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Drupal Core | vendor | – | – |
Unknown from the sources.
Apply the Drupal core updates per vendor instructions; the specific fixed versions are not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
This page as .md · .json · in your agent: get_signal("CVE-2018-7602")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.