PerfoMetrix

All vulnerabilities · Drupal

Drupalgeddon2 (CVE-2018-7600): Remote Code Execution in Drupal 7 and 8

CVE-2018-7600CVSS 9.8Actively exploited (CISA KEV)

Drupalgeddon2 lets anyone run code on unpatched Drupal 7 and 8 sites without logging in. Fixed versions, how to check your site and what to do if it ran unpatched.

Is your site affected? Check the Drupal version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
<=7.57
>=8.0.0 <8.3.9
>=8.4.0 <8.4.6
>=8.5.0 <8.5.1
7.58
8.3.9
8.4.6
8.5.1

Drupalgeddon2 is a flaw in Drupal’s Form API: specially built form requests are processed as code. Anyone on the internet could run commands on an unpatched site without an account. Mass attacks started within two weeks of the fix in March 2018 and still continue against forgotten sites.

Who is affected

Drupal 7 before 7.58 and Drupal 8 before 8.3.9, 8.4.6 and 8.5.1. Drupal 6 was already out of support and also affected.

What our check looks at

Drupal usually announces only its major version (Drupal 7) in the generator tag and the X-Generator header, which isn’t enough to tell whether this fix is installed. We show the detected major version; confirm the exact version in the site’s status report.

How to fix it

  1. Update Drupal 7 to the latest 7.x release; move Drupal 8 to a supported major version (Drupal 10 or 11).
  2. If the site ran unpatched after April 2018, assume it was compromised: check for unknown files and users, and restore from a clean backup if needed.

FAQ

Our site shows “Drupal 7”. Is it affected?

We can’t tell from the major version. Check Reports → Status report for the exact version; 7.58 and later contain the fix. Drupal 7 itself reached end of life in January 2025.

Is a WAF enough?

No. Drupalgeddon2 has many variants; only updating removes it.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free