Critical Remote Code Execution in Drupal Core (CVE‑2018‑7602) Threatens Web Sites
What It Is – A remote code execution (RCE) flaw in Drupal Core allows an attacker to execute arbitrary commands on vulnerable sites by sending specially‑crafted requests. The vulnerability spans multiple subsystems, giving attackers several vectors to compromise a Drupal installation.
Exploitability – Publicly disclosed in 2018; proof‑of‑concept exploits are available and the CVSS base score is 9.8 (Critical). No patch was applied to many sites for years, keeping the flaw actively exploitable.
Affected Products – Drupal Core (all supported versions prior to the security release that addressed CVE‑2018‑7602).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – The flaw tests the control objective of maintaining an up‑to‑date, securely configured software stack. Continuous patch monitoring and evidence of remediation are essential to demonstrate due diligence.
- Audit Readiness – Organizations must be able to produce defensible proof (e.g., scan reports, patch‑install logs) that the vulnerability was identified and mitigated in a timely manner.
- Enterprise Buyer Expectations – Modern procurement contracts increasingly require demonstrable control assurance that web‑application platforms are free of known critical RCE bugs.
Recommended Actions
- Inventory all Drupal instances across your environment.
- Verify the exact version; upgrade to the patched release (Drupal 8.5.1 or later, or the equivalent for your major version).
- Run an authenticated web‑application scanner to confirm the vulnerability is closed.
- Document the remediation steps and retain scan evidence for audit purposes.
- Incorporate automated patch‑validation into your continuous monitoring pipeline.
Source: CISA KEV – CVE‑2018‑7602