CVE-2026-118539
6.5CVSS base score · medium (NVD)
0.2%Chance of exploitation in the next 30 days (FIRST EPSS)
Not in KEVNo confirmed exploitation in CISA's catalog yet
What happened
Threat actors are actively exploiting CVE-2026-118539, a critical missing authorization flaw in Drupal Commerce Core. The vulnerability affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, allowing unauthorized actions in the shopping cart and e-commerce functionality. Organizations running affected Drupal Commerce versions should patch immediately. Monitor for suspicious account activity and unauthorized transactions.
From the Intel60 brief of Oct 30, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalDrupal Commerce Core authorization bypass actively exploitedOct 30, 2026