Drupal security advisory (AV26-1105)

Reported by Canadian Centre for Cyber Security

Summary by Cyber Security News30 Oct 2026, 16:43 CET

About this summary. This is a short excerpt from the description that Canadian Centre for Cyber Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://cyber.gc.ca/en/alerts-advisories/drupal-security-advisory-av26-1105

Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to 2.41 and 3.0.0 versions prior to 3.3.13 Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Read the full article at Canadian Centre for Cyber Security →

Source attribution: headline and facts are from Canadian Centre for Cyber Security (cyber.gc.ca). Summary method: excerpt of the source description. See our source attribution policy.