Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
VULNERABILITYCVE-2026-118539redteam/daily · 4 sources
- Severity
- High
- Highest CVSS
- 6.5
- Exploited
- Yes
- Sources
- 4
What happened
Drupal has warned that attackers are already abusing a serious flaw in Commerce Core, the add-on that lets Drupal websites run online shops. The flaw means some checks on who is allowed to do what are missing, which could let attackers change store data or see private information. Shop owners should install the fixed version and check their recent orders for anything odd.
Like I’m new · Written by AI from 4 sources · Wrong?
What to do
- CVE-2026-9082 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use Drupal Core: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 6 updates
- Fri 22 MayCVE-2026-9082 added to CISA’s exploited listCISA KEV
- Fri 30 OctoberCVE-2026-118539 published, CVSS 6.5NVD
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawThe Hacker News
- Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01Cyber Security News
- Drupal security advisory (AV26-1105)Canadian Centre for Cyber Security
- Sat 31 OctoberAttackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539Security Affairs
Who reported · 4 outlets
The Hacker NewsCyber Security NewsCanadian Centre for Cyber SecuritySecurity Affairs