Drupal
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Named in breach reports by Check Point ResearchBinance and Polymarket crypto thefts, airline and state data breaches, and exploited flaws in Cisco, Drupal and Linux
- Vulnerability reported by The Hacker NewsDrupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
Recent news
Binance and Polymarket crypto thefts, airline and state data breaches, and exploited flaws in Cisco, Drupal and Linux
Binance reportedly lost about $6.3 billion in digital assets after a DevOps engineer's laptop was compromised, and the incident is linked to a North Korean group. Polymarket lost about $2.7 million through malicious JavaScript delivered by a compromised third-party service, while Japan Airlines and the Florida Department of Education reported breaches affecting about 92,000 passengers and 4.9 million individuals. Actively exploited flaws include HTTP2Shell (CVE-2026-111497), a Cisco SSL VPN crash bug (CVE-2026-76418) and a Drupal Commerce Core access control flaw (CVE-2026-118539).
Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
Drupal reports active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, rated highly critical (21 out of 25 on Drupal's own scale, not CVSS). It affects versions before 2.41 and 3.0.0 up to but not including 3.3.13, and needs no authentication. Administrators should update to 2.41 or 3.3.13 and audit orders against expected prices and payment records.