Security2 hOctober 30, 2026, 14:45

Drupal Commerce Core authorization bypass flaw actively exploited

Drupal warned that threat actors are actively exploiting a "highly critical" authorization bypass in its Commerce Core component. The flaw, tracked as CVE-2026-118539, affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13.

The Hacker News

Open source

CVE-2026-118539 is a missing authorization flaw in Commerce Core
Affected versions: 0.0.0–2.41 and 3.0.0–3.3.13
Drupal says the vulnerability is being exploited in the wild

#Drupal

Drupal warns of fast exploitation risk for critical core RCE flaws

Security

Three Artifactory flaws under active exploitation allow auth bypass and admin access

Security

Cisco patches critical SD-WAN Manager auth bypass under active exploit

Security

Drupal Commerce Core authorization bypass flaw actively exploited

Drupal warns of fast exploitation risk for critical core RCE flaws

Three Artifactory flaws under active exploitation allow auth bypass and admin access

Cisco patches critical SD-WAN Manager auth bypass under active exploit

CISA adds Google Brotli and Adobe Commerce flaws to exploited vulnerabilities catalog