This vulnerability is being exploited in the wild.
4/26/18: Drupal released critical updates addressing a vulnerability in Drupal 7 and 8. A remote attacker could exploit this vulnerability to take control of an affected system. Please review Drupal’s Security Advisory and apply the necessary updates.
3/29/18: Drupal released updates addressing a serious vulnerability in Drupal 6, 7 and 8. Please review Drupal’s Security Advisory and apply the necessary updates.