E-Commerce

vulnerabilities 2026-11-01
CVE-2026-118539: Drupal Commerce Core Access Bypass Exploited in the Wild Against Online Stores
Drupal rates SA-CONTRIB-2026-254 'highly critical' and confirms active exploitation of an unauthenticated access bypass in Commerce Core (CVE-2026-118539); fixes are in 3.3.13 and 8.x-2.41.
active-exploitation authentication-bypass drupal e-commerce web-application

CVE-2026-118539: Drupal Commerce Core Access Bypass Exploited in the Wild Against Online Stores