Search — “CVE-2026-118539”

Drupal warned administrators that CVE-2026-118539, a missing-authorization access bypass in the Commerce Core module, is being actively exploited against unauthenticated attackers. The sources say the flaw affects Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13, with fixes in 3.3.13 and 8.x-2.41, and advise auditing orders for inconsistencies; no specific exploitation artifacts, log patterns, or indicators are published. Hunters should review order records for unexpected modifications and check exposed routes and entity fields for unauthenticated access.