Drupal has issued a warning that threat actors are exploiting a critical security flaw in its Commerce Core component, affecting versions from 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
The vulnerability or weakness
The vulnerability, CVE-2026-118539, is a missing authorization issue that allows for an access bypass, potentially impacting vendors financially.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-109619 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-118539 | n/a | not scored | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls (2026-10-29)
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open (2026-10-29)
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys (2026-10-29)
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls (2026-10-28)
- Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers (2026-10-28)
Business impact
Organizations using affected versions of Drupal's Commerce Core face financial risks and potential operational disruptions due to unauthorized access.
Industries affected
The vulnerability affects businesses in e-commerce and content management sectors, particularly those running Drupal websites.
Users affected
Users and customers of affected Drupal sites may have their data and transactions exposed to risks, impacting trust and security.
