security8 days ago
Active Exploitation of Drupal Commerce Core Authorization Bypass Flaw
Threat actors are actively exploiting a highly critical authorization bypass vulnerability in Drupal Commerce Core, affecting versions up to 3.3.13 and 2.41. The flaw, identified as CVE-2026-118539, allows attackers to bypass access controls on certain routes and entity fields, potentially causing financial harm to vendors. Drupal has released patches for Commerce Core 3.3.13 and 8.x-2.41, urging immediate updates. This incident coincides with active exploitation of two critical PHP vulnerabilities, known as PHP2Shell, which have affected over 50% of organizations, though recent data shows a decline in affected systems.