Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

T2Covered by 1 source · first reported by The Hacker News at 30 Oct, 07:45 UTC

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13…

security

Sources

• T2Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawThe Hacker News30 Oct, 07:45

Vulnerabilities

• CVE-2026-118539