The vulnerability is an OS Command Injection, also known as CWE-78, that allows an attacker to execute arbitrary operating system commands within Drupal Cloud. This flaw permits the compromise of confidentiality, integrity, and availability of affected systems, enabling a complete takeover of the underlying platform.

Drupal Cloud deployments running any version from 0.0.0 up to and including 7.0.1 are potentially vulnerable. The issue is tied specifically to the Cloud product line of Drupal. If your environment uses any of these versions, it is in scope for remediation.

The EPSS score is < 1%, indicating a very low exploitation probability. The CVSS score of 6.4 classifies the vulnerability as moderate severity, although the remote code execution potential remains a high impact risk. Exploitation would require the attacker to supply crafted input that is not properly neutralized; no publicly disclosed exploit is known, yet the potential for a successful compromise is high given the remote code execution nature of the flaw and the absence of active defensive mitigations in the vulnerable range.