Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Summary: Drupal warned that threat actors are exploiting a "highly critical" missing authorization flaw in its Commerce Core component, tracked as CVE-2026-118539, affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal said the module does not sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor, and recommended updating to the latest version.
Bottom line: The flaw sits in the module merchants use to run carts, checkout, and API-driven storefronts, and Drupal states it is already being exploited in the wild while giving no details on the campaign's scope.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-109618CVE-2026-109619CVE-2026-118539
- Related
- Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) Cyber Risks · Oct 29, 2026