{"id":3884,"date":"2026-10-30T08:56:53","date_gmt":"2026-10-30T08:56:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3884"},"modified":"2026-10-30T08:56:53","modified_gmt":"2026-10-30T08:56:53","slug":"hackers-actively-exploit-highly-critical-drupal-commerce-core-authorization-bypass-flaw","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3884","title":{"rendered":"Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 30, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Drupal has warned that threat actors are exploiting a \u00abhighly critical\u00bb security flaw in its Commerce Core component.<\/p>\n

The vulnerability, tracked as CVE-2026-118539<\/a><\/strong> (CVSS score: N\/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.<\/p>\n

\u00abThis module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs,\u00bb Drupal said<\/a> in an advisory.<\/p>\n

\u00abThe module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.\u00bb<\/p>\n

The open-source content-management framework acknowledged that the vulnerability is being \u00abactively exploited in the wild,\u00bb but provided no specifics about the nature of the activity or the extent of the campaign.<\/p>\n

Users are being recommended to update to the latest version –<\/p>\n