Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-7600

99
FAUCET Score

CVE-2018-7600, also known as "Drupalgeddon2," is a critical remote code execution vulnerability affecting Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1. This flaw allows unauthenticated attackers to execute arbitrary code on vulnerable Drupal installations due to issues in multiple subsystems, even with default or common module configurations. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk, enabling complete compromise of confidentiality, integrity, and availability. This vulnerability is actively exploited, listed in CISA's KEV catalog, and has publicly available exploit modules in Metasploit and Nuclei, along with extensive community discussion and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 7.57CPE matchmatch criteria
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
>= 8.0.0, < 8.3.9CPE matchmatch criteria
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
>= 8.4.0, < 8.4.6CPE matchmatch criteria
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
>= 8.5.0, < 8.5.1CPE matchmatch criteria
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
99.99%
Probability of exploitation in next 30 days
EPSS Percentile
100.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
Added to KEV · Nov 3, 2021
Metasploit: Drupal Drupalgeddon 2 Forms API Property Injection · Mar 28, 2018
Nuclei: CVE-2018-7600 · Feb 15, 2021
ExploitDB: EDB-44482 · Apr 17, 2018
This CVE's current EPSS score of 0.9999 is in the 100th percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

composerpatch availablevia ghsa
Product: drupal/coreFixed in: 7.58
composerpatch availablevia ghsa
Product: drupal/coreFixed in: 8.3.9
composerpatch availablevia ghsa
Product: drupal/coreFixed in: 8.4.6
composerpatch availablevia ghsa
Product: drupal/coreFixed in: 8.5.1
composerpatch availablevia ghsa
Product: drupal/drupalFixed in: 7.58
composerpatch availablevia ghsa
Product: drupal/drupalFixed in: 8.3.9
composerpatch availablevia ghsa
Product: drupal/drupalFixed in: 8.4.6
composerpatch availablevia ghsa
Product: drupal/drupalFixed in: 8.5.1
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-7fh9-933g-885pcritical

Drupal Core Remote Code Execution Vulnerability

May 14, 2022

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
badpackets.net / over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600
Broken LinkThird Party Advisory
blog.appsecco.com / remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714
Third Party Advisory
github.com / a2u/CVE-2018-7600
Third Party Advisory
github.com / g0rx/CVE-2018-7600-Drupal-RCE
PatchThird Party Advisory
greysec.net / showthread.php
Broken LinkIssue TrackingThird Party Advisory
groups.drupal.org / security/faq-2018-002
Vendor Advisory
lists.debian.org / debian-lts-announce/2018/03/msg00028.html
Third Party Advisory
research.checkpoint.com / uncovering-drupalgeddon-2
ExploitThird Party Advisory
twitter.com / arancaytar/status/979090719003627521
Third Party Advisory
twitter.com / RicterZ/status/979567469726613504
Broken LinkThird Party Advisory
twitter.com / RicterZ/status/984495201354854401
Broken LinkThird Party Advisory
debian.org / security/2018/dsa-4156
Third Party Advisory
drupal.org / sa-core-2018-002
Vendor Advisory
exploit-db.com / exploits/44448
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/44449
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/44482
ExploitThird Party AdvisoryVDB Entry
synology.com / support/security/Synology_SA_18_17
Third Party Advisory
tenable.com / blog/critical-drupal-core-vulnerability-what-you-need-to-know
Third Party Advisory
securityfocus.com / bid/103534
Broken LinkThird Party AdvisoryVDB Entry
securitytracker.com / id/1040598
Broken LinkThird Party AdvisoryVDB Entry