Security support for Drupal 7
Drupal 7 reached end of life on 5 January 2025, and many sites still run it. 7.103 is its last release. These are the vulnerabilities the US National Vulnerability Database lists for it.
Request a server assessmentDrupal 7
| Drupal | Release | End of life | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|---|
| 7.103 | Last Drupal 7 release | 5 January 2025 | 5 | 0 | 0 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where Drupal itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Your assessment shows which of them are real on your systems.
PHP under Drupal 7
Drupal 7 sites often run on PHP 5.6 to 7.4, past end of life too. PHP versions
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans