Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Summary
Drupal has issued a warning about threat actors actively exploiting a critical security flaw in its Commerce Core component. The vulnerability, identified as CVE-2026-118539, is a missing authorization flaw affecting specific versions of the module.
IFF Assessment
The discovery and active exploitation of a critical vulnerability represent bad news for defenders, as it creates an immediate risk to systems and data.
Defender Context
This article highlights a critical vulnerability in a widely used e-commerce module for Drupal. Defenders should prioritize patching affected Drupal Commerce Core installations to prevent unauthorized access and potential compromise. Organizations using this module should review their security configurations and implement additional access controls where possible.