Critical Remote Code Execution in Drupal Core (CVE-2018-7600) Threatens CMS Sites
What It Is – Drupal Core contains a remote‑code‑execution (RCE) flaw (CVE‑2018‑7600) that lets an attacker execute arbitrary commands on a vulnerable site, potentially leading to full compromise.
Exploitability – Public exploits and proof‑of‑concept code exist; the vulnerability scores 9.8 (CVSS v3.1), classifying it as Critical.
Affected Products – Drupal CMS (all supported versions prior to the patches released in March 2018).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring as evidence of due‑diligence.
- Timely patching and documented remediation provide a defensible audit trail for regulators and enterprise buyers.
- Mapping this fix to a control objective (vulnerability management) satisfies multiple framework requirements (e.g., NIST CSF Identify‑Risk Management, ISO 27001 A.12.6).
Recommended Actions
- Inventory all Drupal instances and verify they run a patched version (≥ 7.58, 8.5.1, or later).
- Deploy automated web‑application scanning to detect unpatched CMS platforms.
- Record patch‑deployment dates, responsible owners, and verification results for audit readiness.
Source: CISA KEV – CVE‑2018‑7600