TThe Hacker NewsinCVE·critical
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has warned that threat actors are actively exploiting a highly critical authorization bypass vulnerability in the Commerce Core module. The flaw, tracked as CVE-2026-118539, affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Exploitation allows unauthorized access to e-commerce sites, with Drupal releasing security updates to address the issue.
11m
