criticalCVE
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Unauthenticated attackers can gain unauthorized access to e-commerce installations, Drupal warns
Cyber.TechVoid1 min read
Key Takeaways
- Drupal Commerce Core authorization bypass flaw CVE-2026-118539 is being actively exploited in the wild.
- Affected versions include Commerce Core 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
- The vulnerability allows unauthorized access due to missing authorization checks.
- Drupal has released security updates; users should update to patched versions immediately.
Related Security News
criticalCVE
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws impacting GitLab and Cisco software to its Known Exploited Vulnerabilities (KEV) catalog. The inclusion is based on evidence of active exploitation observed in the wild. Organizations using the affected products are urged to apply mitigations immediately.
The Hacker News1 min read
