{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adrupalcommercedrupal/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:drupal:commerce:*:*:*:*:*:drupal:*:*"],"_cs_cves":[{"id":"CVE-2026-118539"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Commerce Core (versions before 3.3.13)","Commerce Core (versions before 8.x-2.41)"],"_cs_severities":["critical"],"_cs_tags":["web-application-vulnerability","access-bypass","e-commerce","active-exploitation"],"_cs_type":"threat","_cs_vendors":["Drupal"],"content_html":"\u003cp\u003eDrupal has identified a highly critical access bypass vulnerability, tracked as CVE-2026-118539, affecting the Commerce Core module. The vulnerability allows unauthenticated attackers to exploit insufficient protection on specific routes and entity fields. The Drupal security team has assigned this issue a risk score of 21/25, noting that it is being actively exploited in the wild.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a direct financial risk to vendors using the affected module. Exploitation may allow attackers to manipulate commerce-related data, including the checkout process and order states. Drupal specifically urges administrators to audit store orders for inconsistencies.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Drupal Commerce Core module to version 3.3.13 or 8.x-2.41 immediately.\u003c/li\u003e\n\u003cli\u003eReview all commerce transactions and order logs for unauthorized changes, inconsistencies, or anomalies that occurred prior to patching.\u003c/li\u003e\n\u003cli\u003eAudit Drupal instances for the presence of the vulnerable Commerce Core module versions if not already managed via centralized inventory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T11:41:41Z","date_published":"2026-10-30T11:41:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-drupal-commerce-bypass/","summary":"An unauthenticated access bypass vulnerability in the Drupal Commerce Core module is being actively exploited in the wild, leading to potential financial impact on affected e-commerce platforms.","title":"Drupal Commerce Core: Access Bypass Vulnerability (CVE-2026-118539)","url":"https://feed.craftedsignal.io/briefs/2026-10-drupal-commerce-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:drupal:commerce:*:*:*:*:*:drupal:*:*","version":"https://jsonfeed.org/version/1.1"}