Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
VULNERABILITYCVE-2026-118539redteam/daily · 4 sources
- Severity
- High
- Highest CVSS
- 6.5
- Exploited
- Yes
- Sources
- 4
What happened
Drupal reports active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, rated highly critical (21 out of 25 on Drupal's own scale, not CVSS). It affects versions before 2.41 and 3.0.0 up to but not including 3.3.13, and needs no authentication. Administrators should update to 2.41 or 3.3.13 and audit orders against expected prices and payment records.
For IT people · Written by AI from 4 sources · Wrong?
What to do
- CVE-2026-9082 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use Drupal Core: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 6 updates
- Fri 22 MayCVE-2026-9082 added to CISA’s exploited listCISA KEV
- Fri 30 OctoberCVE-2026-118539 published, CVSS 6.5NVD
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawThe Hacker News
- Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01Cyber Security News
- Drupal security advisory (AV26-1105)Canadian Centre for Cyber Security
- Sat 31 OctoberAttackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539Security Affairs
Who reported · 4 outlets
The Hacker NewsCyber Security NewsCanadian Centre for Cyber SecuritySecurity Affairs