Is Drupal 7 Still Supported? End-of-Life Dates (2026)
Short answer
Drupal 7 is no longer supported: vendor support ended on 5 Jan 2025 (21 months ago). CISA’s Known Exploited Vulnerabilities catalog lists 6 vulnerabilities that affect Drupal 7, matched to its versions through NVD data.
Drupal 7 core has had no community security updates since 5 January 2025, the final date after several extensions; sites that cannot migrate can buy patches from vendors certified in the Drupal Association's Extended Security Support Provider Program.
Legacy Technology Tracker · Status as of 16 Oct 2026. Data checked 7 Oct 2026; refreshed monthly, with quarterly snapshots kept unchanged.
Risk rating
High: support ended 5 Jan 2025; 6 vulnerabilities on CISA's KEV list; no releases since support ended. How ratings work
Key facts
Every value links to its source and shows when we last checked or retrieved it. Data checked 7 Oct 2026; status as of 16 Oct 2026.
| Fact | Value | Source | Checked |
|---|---|---|---|
| Support status | UnsupportedDrupal 7 core. | ||
| End of mainstream support | |||
| End of standard support (security updates) | |||
| Extended support offer | Drupal 7 Extended Security Support vendors (Drupal Association programme) (third party), no end date published | ||
| Known exploited vulnerabilities (CISA KEV) | 6 CVEs all time; 1 added in the last 24 monthsNewest added 23 Jan 2025Scoped to these versions through NVD product (CPE) data. Scoped to Drupal 7.x via NVD CPE version range; KEV lists 'Drupal Core' without versions. | ||
| Home pages using Drupal, all versions (HTTP Archive, mobile) | 94,439 (1.1% of the crawl), Aug 2026 | ||
| Home pages using Drupal, all versions (HTTP Archive, desktop) | 81,952 (1.5% of the crawl), Aug 2026 | ||
| Same measure 12 months earlier (mobile) | 110,291 (1.2% of the crawl), Aug 2025 | ||
| Home pages on the versions in scope (HTTP Archive, mobile) | 16,397 (0.18% of the crawl), Aug 2026Version-scoped count = Drupal 7 where the version is detectable. | ||
| Last release | 7.103, 4 Dec 2024Maintainer: Drupal project (GitHub mirror) | ||
| Job postings and salaries | Not tracked for this entry | — | — |
Versions in scope
Drupal 7 core. Dates per version, each with its source.
| Version | Status | Standard support ends | Extended support ends | Latest release | Source | Checked |
|---|---|---|---|---|---|---|
| 7 | Unsupported | — | 7.103 (4 Dec 2024) |
If you still run Drupal 7
Drupal's deadline passed on 5 January 2025, after several extensions. Drupal 7 core no longer receives community security or compatibility updates.
The realistic options:
- Migrate to current Drupal. Drupal.org's end-of-life page recommends this and points to Certified Migration Partners. Moving to a current release is a migration, not an in-place upgrade: content and configuration are carried across, and custom modules and themes are rebuilt for the new version.
- Buy extended security support. The Drupal Association's program certifies vendors who patch Drupal 7 after the end date. It supplies security patches while you plan the move; prices and terms are set by each vendor, and the patches come from the vendor, not from the Drupal security team.
- Move to another platform. If the site is being redesigned anyway, a different CMS is a legitimate target.
Whichever you choose, tell customers, managers and your security lead what the plan is. Drupal.org advises this because unpatched software can put the site out of compliance with standards such as PCI and SOC 2.
For suppliers, see legacy application modernization companies. Modernization costs gives budget context.
Frequently asked questions
Is Drupal 7 still supported?
No. Drupal.org states that Drupal 7 security support ended on 5 January 2025 and that it will no longer receive security or compatibility updates (Drupal 7 end of life). It directs sites to the latest Drupal release.
Can I get extended support for Drupal 7?
Yes, through the Drupal Association's Extended Security Support Provider Program. As of 7 October 2026, drupal.org lists HeroDevs and Tag1 Consulting as the certified vendors on its partners page. Each vendor sets its own price and terms.
Is it safe to run Drupal 7 without a patch provider?
Drupal.org warns that an unpatched Drupal 7 site is exposed to security risks and may fall out of compliance with standards such as FedRAMP, PCI, HIPAA and SOC 2.
How do I move off Drupal 7?
Drupal.org recommends migrating to the latest Drupal release and lists Certified Migration Partners and a Migration Resource Center on its end-of-life page. Other CMS platforms are an alternative if the site is being redesigned.