CVE-2026-118539

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

CVSS

—

EPSS

—

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

PUBLISHED

Coverage

• 

  The Hacker News◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record5 hours ago

  Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

  Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13…

  ↗thehackernews.com/2026/10/hackers-actively-expl…(opens the publisher's site in a new tab)

What we observed