Covered by 2 outlets — first reported by The Hacker News, Oct 30, 07:45 UTC
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
MentionsDrupal
Summary
Drupal has warned that attackers are exploiting a critical flaw in Commerce Core, the module that adds a shopping cart and online sales to Drupal websites. The flaw, tracked as CVE-2026-118539, is a missing authorization check that lets attackers bypass access controls. Drupal rates it highly critical and says it affects Commerce Core versions up to 2.41 and from 3.0.0 to 3.3.13, and it has urged administrators to patch.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, BleepingComputer. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce…
BleepingComputer
Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
Explained
The technology and terms in this story. Learn more
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.