Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks.
Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539
About this summary. This is a short excerpt from the description that Security Affairs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securityaffairs.com/202162/security/attackers-exploit-critical-drupal-commerce-core-vulnerability-cve-2026-118539.html
Source attribution: headline and facts are from Security Affairs (securityaffairs.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Drupal security advisory (AV26-1105)
Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to…
Adobe security advisory (AV26-697) – Update 1
Serial number: AV26–697 Date: July 14, 2026 Updated: October 27, 2026 On July 14, 2026, Adobe published security advisories to address critical vulnerabilities in the…
Gitea security advisory (AV26-845) - Update 1
Serial Number: AV26-845 Date: August 25, 2026 Updated: October 20, 2026 As of August 14, 2026, Gitea is affected by vulnerabilities in the following product: Gitea Prior…
F5 addressed critical RCE flaws in NGINX
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm…
U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S.
CAPE - Context-Aware Prioritization Engine for Vulnerability Scoring and Management
arXiv:2610.13071v1 Announce Type: new Abstract: Vulnerability patching is critical for safeguarding an enterprise's software ecosystem from cyber attacks. However…