CVE-2026-9082
NVD has not published a description yet.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
CISA says: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Show me how to fix itTimeline
- Added to CISA known exploited list
- First covered by RedTeamDaily
Coverage
Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
Drupal reports active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, rated highly critical (21 out of 25 on Drupal's own scale, not CVSS). It affects versions before 2.41 and 3.0.0 up to but not including 3.3.13, and needs no authentication. Administrators should update to 2.41 or 3.3.13 and audit orders against expected prices and payment records.
Sources: NVD and CISA known exploited vulnerabilities catalogue.