Commerce Core (Versions Before 3.3.13) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/commerce-core-versions-before-3.3.13/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 11:41:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDrupal Commerce Core: Access Bypass Vulnerability (CVE-2026-118539)https://feed.craftedsignal.io/briefs/2026-10-drupal-commerce-bypass/Fri, 30 Oct 2026 11:41:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-drupal-commerce-bypass/An unauthenticated access bypass vulnerability in the Drupal Commerce Core module is being actively exploited in the wild, leading to potential financial impact on affected e-commerce platforms.Drupal has identified a highly critical access bypass vulnerability, tracked as CVE-2026-118539, affecting the Commerce Core module. The vulnerability allows unauthenticated attackers to exploit insufficient protection on specific routes and entity fields. The Drupal security team has assigned this issue a risk score of 21/25, noting that it is being actively exploited in the wild.

Impact

The vulnerability poses a direct financial risk to vendors using the affected module. Exploitation may allow attackers to manipulate commerce-related data, including the checkout process and order states. Drupal specifically urges administrators to audit store orders for inconsistencies.

Recommendation

  • Upgrade the Drupal Commerce Core module to version 3.3.13 or 8.x-2.41 immediately.
  • Review all commerce transactions and order logs for unauthorized changes, inconsistencies, or anomalies that occurred prior to patching.
  • Audit Drupal instances for the presence of the vulnerable Commerce Core module versions if not already managed via centralized inventory.
]]>criticalthreatweb-application-vulnerabilityaccess-bypasse-commerceactive-exploitation