Act
active
Drupal Commerce Core Auth Bypass CVE-2026-118539 Actively Exploited
- Engineer — Act: Active exploitation plus a public GitHub PoC means immediate patching is warranted: upgrade Commerce Core to 3.3.14+ (3.x users) or 2.42+ (2.x users) and audit Commerce order/checkout endpoints for signs of unauthorized access.
- SOC/IR — Act: Active exploitation with a public PoC is in progress — review web application and access logs for anomalous requests to Drupal Commerce endpoints (order management, checkout, admin) dating back at least two weeks and tune WAF rules for authorization-bypass patterns against this module.
- Leader — Plan: Scope is limited to organizations running Drupal-based e-commerce; confirm whether any internal or customer-facing properties use Drupal Commerce Core and verify engineering has patched or has a dated remediation plan.
- Signals: CVE-2026-118539 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.