Drupal on CuraSec

Drupal Commerce Core Auth Bypass CVE-2026-118539 Actively Exploited

Fri, 30 Oct 2026 17:01:08 +0000

Engineer — Act: Active exploitation plus a public GitHub PoC means immediate patching is warranted: upgrade Commerce Core to 3.3.14+ (3.x users) or 2.42+ (2.x users) and audit Commerce order/checkout endpoints for signs of unauthorized access.
SOC/IR — Act: Active exploitation with a public PoC is in progress — review web application and access logs for anomalous requests to Drupal Commerce endpoints (order management, checkout, admin) dating back at least two weeks and tune WAF rules for authorization-bypass patterns against this module.
Leader — Plan: Scope is limited to organizations running Drupal-based e-commerce; confirm whether any internal or customer-facing properties use Drupal Commerce Core and verify engineering has patched or has a dated remediation plan.
Signals: CVE-2026-118539 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub

Fri, 30 Oct 2026 17:01:08 +0000

Engineer — Act: Drupal itself has confirmed active exploitation of this critical access bypass in Commerce Core — patch to the fixed version immediately if you run any Drupal e-commerce sites; check for signs of unauthorized access to orders or admin functions.
SOC/IR — Plan: Active exploitation is confirmed but the item provides no IOCs or ATT&CK-mappable TTPs; build or tune web-application detections for abnormal access patterns on Drupal Commerce endpoints and review web server logs back to patch disclosure date.
Leader — Plan: Verify whether Drupal Commerce is in your environment or any third-party vendor’s stack; active exploitation of an e-commerce access-bypass raises customer/payment-data exposure risk that may require notification review if compromise is found.

Sun, 18 Oct 2026 14:33:13 +0000

Engineer — Plan: Two critical RCE flaws affect all supported Drupal versions with no PoC or KEV yet, but the project itself warns exploitation is imminent — update Drupal core to the patched release this sprint rather than waiting for the next maintenance window.
SOC/IR — Skip
Leader — Skip

Thu, 15 Oct 2026 15:35:13 +0000

Engineer — Act: If you run Drupal with contributed modules, patch immediately to 11.4.10, 11.3.19, or 10.6.19; at least one unauthenticated exploit path is known. Audit which contributed modules are enabled and prioritize sites with public-facing Field UI exposure.
SOC/IR — Learn: No published IOCs or ATT&CK-mapped TTPs in this advisory; monitor for exploitation reports against Drupal-hosted assets and be ready to hunt for web shell drops on CMS servers if active exploitation is confirmed.
Leader — Skip