As cited
Copy frozen at (site build).
vulnerabilities
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has disclosed active exploitation of CVE-2026-118539, a missing authorization vulnerability in Commerce Core affecting versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Threat actors are actively exploiting this highly critical flaw that impacts the shopping cart functionality.
Why it matters: Organizations running vulnerable Drupal Commerce Core versions must patch immediately, as this authorization bypass is being actively exploited in the wild and could allow attackers to perform unauthorized actions in e-commerce operations.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has disclosed active exploitation of CVE-2026-118539, a missing authorization vulnerability in Commerce Core affecting versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Threat actors are actively exploiting this highly critical flaw that impacts the shopping cart functionality.
Why it matters: Organizations running vulnerable Drupal Commerce Core versions must patch immediately, as this authorization bypass is being actively exploited in the wild and could allow attackers to perform unauthorized actions in e-commerce operations.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal Commerce Core contains a missing authorization vulnerability, tracked as CVE-2026-118539 with a CVSS score of 6.5, affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Threat actors are actively exploiting this flaw to bypass authorization controls in the e-commerce component.
Why it matters: Organizations running vulnerable Drupal Commerce Core versions face immediate risk of unauthorized access to shopping cart and transaction functionality; patching to versions 2.42 or 3.3.14 and later is critical.
- Source published
- First seen by Cybersecurity Tracker