Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

October 30, 2026 · 7:45 am 1 sources

Image: The Hacker News

Coverage

More coverage

• Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
  The Hacker News · October 30, 2026 07:45
  Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.…