# CVE-2018-7602

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

- Page: https://www.vulneraibility.com/cve/CVE-2018-7602
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-04-13; CISA due date 2022-05-04; known ransomware use
- EPSS: 99.17% (percentile 99.9)
- Public exploit code: 3 on Exploit-DB · 5 GitHub proofs of concept · 1 Nuclei template (first 2018-04-25)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2026-08-13)
- Weakness: CWE-94
- Published: 2018-07-19

## Affected versions

- Drupal core: affected < 7.59; < 8.5.3; < 8.4.8

A version outside these ranges is not a statement that it is unaffected.

## References

- [exploit] https://www.exploit-db.com/exploits/44557/
- [other] http://www.securitytracker.com/id/1040754
- [other] https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html
- [exploit] https://www.exploit-db.com/exploits/44542/
- [advisory] https://www.debian.org/security/2018/dsa-4180
- [other] https://www.drupal.org/sa-core-2018-004
- [other] http://www.securityfocus.com/bid/103985
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.