CVE-2018-7600: Drupal Core input validation flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network reachability, near-maximum EPSS, CISA KEV listing with known ransomware use, and public exploit code make this an urgent patch-first issue.

What it is

Drupal core before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 fails to properly validate input across multiple subsystems, allowing remote code execution under default or common module configurations. Because the flaw is reachable without authentication and affects widely deployed core code, it is a high-value target for mass exploitation.

Impact

An unauthenticated remote attacker can execute arbitrary code on the Drupal server, leading to full compromise of the web application and its data. CISA KEV notes known ransomware campaign use, so follow-on impact can include ransomware deployment.

Attack surface

Reached over the network via HTTP requests to the Drupal site; the CVSS vector shows no privileges required and no user interaction, so no authentication is needed. The description states the issue affects multiple subsystems with default or common module configurations, meaning standard deployments are exposed.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is near 1.0 (0.99991, 99.986th percentile). Multiple references are tagged Exploit, including Exploit-DB entries and a Check Point research writeup.

What to do

• Upgrade Drupal core to 7.58, 8.3.9, 8.4.6, or 8.5.1 (or later) per the vendor advisory sa-core-2018-002.
• Apply the Debian security update DSA-4156 for packaged Drupal installs.
• If immediate patching is not possible, restrict or block external access to the affected Drupal site and apply vendor-recommended workarounds.
• Review and harden Drupal module configurations, since default or common module setups are affected.
• Monitor for and remove any web shells or unauthorized files left by prior exploitation.

Detection

• Inspect web server and Drupal logs for POST requests with unusual or malformed parameters targeting Drupal endpoints, consistent with public exploit PoCs.
• Hunt for unexpected child processes spawned by the web server user (for example PHP spawning shell or network utilities).
• Monitor for new or modified files under the Drupal webroot, especially executable PHP files, indicating dropped web shells.
• Alert on outbound network connections from the Drupal host to unfamiliar destinations, which may indicate command-and-control or payload retrieval.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.