Ethical Hacking News
Drupal has confirmed that attackers are exploiting a critical authorization flaw in Commerce Core, a module that enables online stores to sell products and services through shopping carts, checkout forms, and APIs. The vulnerability, tracked as CVE-2026-118539, can allow threat actors to bypass authorization checks and potentially gain financially impactful access to vulnerable online stores. Drupal recommends updating installations to the latest available release to mitigate this vulnerability.
Drupal has confirmed that attackers are exploiting a critical authorization flaw in Commerce Core, allowing threat actors to bypass authorization checks. The vulnerability, CVE-2026-118539, can be exploited through forceful browsing and has been actively exploited in the wild. The Commerce Core module is vulnerable to exploitation from version 0.0.0 to 2.41 and 3.0.0 to 3.3.13. The vulnerability can lead to financially impactful access to vulnerable online stores, potentially resulting in sensitive information, financial data, and intellectual property loss. Drupal recommends updating installations to the latest available release to mitigate the vulnerability. The US CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.
In a recent security update, Drupal has confirmed that attackers are exploiting a critical authorization flaw in Commerce Core, a module that enables online stores to sell products and services through shopping carts, checkout forms, and APIs. The vulnerability, tracked as CVE-2026-118539, is a highly critical security flaw that can allow threat actors to bypass authorization checks and potentially gain financially impactful access to vulnerable online stores.
According to the advisory issued by Drupal, the vulnerability is caused by missing authorization checks in the Commerce Core module, which can be exploited by forceful browsing. This issue affects Commerce Core versions from 0.0.0 to 2.41, as well as versions from 3.0.0 to 3.3.13. The maintainers at the open-source project have confirmed that the vulnerability is being actively exploited in the wild, and researchers have reported the issue.
The Commerce Core module is used to enable online stores to sell products and services through shopping carts, checkout forms, and APIs. However, the vulnerability in the module allows threat actors to bypass authorization checks, which can lead to financially impactful access to vulnerable online stores. This can have serious consequences for online stores, including the potential loss of sensitive information, financial data, and intellectual property.
To mitigate this vulnerability, Drupal recommends that users update their installations to the latest available release. For users on earlier releases, it is recommended to move to Commerce Core 8.x-2.41. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that it is a known and actively exploited vulnerability.
In addition to the Commerce Core vulnerability, Drupal has previously warned about other security flaws, including an SQL injection flaw tracked as CVE-2026-9082, which can allow attackers to gain higher privileges, access sensitive information, and execute malicious code remotely. The US CISA has also added other vulnerabilities to its KEV Catalog, including flaws in GitLab, Cisco, and Linux Kernel.
The exploitation of critical vulnerabilities like CVE-2026-118539 highlights the importance of regular security updates, patch management, and vulnerability remediation. As the threat landscape continues to evolve, it is essential for organizations to prioritize security and take proactive measures to protect their systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/Drupal-Commerce-Core-Vulnerability-CVE-2026-118539-A-Critical-Authorization-Flaw-Exposed-ehn.shtml
https://securityaffairs.com/202162/security/attackers-exploit-critical-drupal-commerce-core-vulnerability-cve-2026-118539.html
https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
https://nvd.nist.gov/vuln/detail/CVE-2026-118539
https://www.cvedetails.com/cve/CVE-2026-118539/
https://nvd.nist.gov/vuln/detail/CVE-2026-9082
https://www.cvedetails.com/cve/CVE-2026-9082/
Published: Sat Oct 31 05:56:56 2026 by llama3.2 3B Q4_K_M
