@coderaider76: CVE-2026-118539 | Drupal Commerce Core Severity: HIGHLY CRITICAL (21/25) CWE-862: Missing Authorization Status: Active Exploitation Confirmed A critical access control vulnerability in Drupal Commerce Core is being exploited against live e-commerce websites. On October 28, the Drupal Security Team disclosed an access bypass vulnerability affecting the contributed Commerce Core project. This is not a theoretical risk. The vendor has confirmed exploitation in the wild. 🔴 WHAT HAPPENED? Certain Commerce routes and entity fields lack sufficient authorization checks, potentially allowing attackers to access functionality without appropriate permissions. The vulnerability enables forceful browsing and may compromise the integrity of e-commerce operations. The Commerce maintainers have reported malicious attempts to place fraudulent orders on live websites. 🔴 AFFECTED VERSIONS • Commerce Core 2.x before 2.41 • Commerce Core 3.0.0 through 3.3.12 Fixed versions: • 2.41 • 3.3.13 This vulnerability affects Drupal Commerce, a contributed project, NOT Drupal core itself. 🔴 EXPLOITATION INTELLIGENCE • Active exploitation: Confirmed • CISA KEV: Not listed • EPSS: Not yet available • CVSS: Not yet assigned • Drupal severity: 21/25 The absence of a KEV listing or EPSS score does not mean a vulnerability is low risk. Confirmed exploitation should immediately influence remediation priorities. 🔵 RECOMMENDED ACTIONS 1. Identify installations running Commerce Core. 2. Verify versions: composer show drupal/commerce 3. Upgrade to the appropriate fixed release. 4. Audit recent orders for suspicious activity. 5. Review application logs for unauthorized access. 6. Validate permissions on Commerce routes and APIs. 🔴 THE BIGGER PICTURE Authentication determines WHO you are. Authorization determines WHAT you can do. When authorization controls fail, attackers may manipulate business-critical operations without compromising user credentials. For e-commerce platforms, that can translate directly into financial losses. Wednesday's Weekly Vulnerability Analysis will explore how authorization failures become business logic attacks and why patching alone may not resolve an existing compromise. 📚 SOURCES https://www.drupal.org/sa-contrib-2026-254 https://www.drupal.org/project/commerce https://vulnerability.circl.lu/vuln/CVE-2026-118539 #VulnerabilityOfTheWeek #DrupalSecurity #CVE2026118539 #ApplicationSecurity #VulnerabilityManagement Wester Henderson | Security Research Research • Analyze • Protect

Wes

Open In TikTok:

Region: US

Monday 02 November 2026 16:08:02 GMT