[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faWRKHuqtkyGVdDdbU_VwMDkzwCblUPoConJ5vIYSg5k":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b7944948-0f0d-4a83-8ae6-bd7521357fca","Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539","attackers-exploit-critical-drupal-commerce-core-vulnerability-cve-2026-118539-87d222","Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks. “This module enables you to sell goods and […]","Drupal has issued a warning about a critical authorization vulnerability, CVE-2026-118539, in its Commerce Core module. Attackers are actively exploiting this flaw, which stems from missing authorization checks, to bypass access controls and potentially impact online stores financially. The vulnerability affects specific versions of Commerce Core, and users are urged to update to the latest releases.","Drupal Commerce Core module has a critical authorization flaw, CVE-2026-118539, being exploited.","https:\u002F\u002Fsecurityaffairs.com\u002F202162\u002Fsecurity\u002Fattackers-exploit-critical-drupal-commerce-core-vulnerability-cve-2026-118539.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2014\u002F10\u002Fdrupal.jpg","2026-10-31T09:08:58+00:00","2026-10-31T10:00:11.60675+00:00",8,[17,20],{"name":18,"type":19},"Commerce Core","product",{"name":21,"type":22},"Drupal","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"cve","CVE-2026-118539","Critical authorization flaw in Drupal Commerce Core",[21,18],{"controls":48,"vendors":135},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":40,"name":108,"problem":109,"products":110},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":148},"drupal-commerce-core-authorization-bypass-actively-exploited-1793445641496","Drupal Commerce Core Authorization Bypass Actively Exploited","CVE-2026-118539 exposes a critical flaw in Drupal's Commerce Core module where missing authorization checks allow attackers to bypass access controls entirely. This means unauthenticated or low-privileged users can perform actions reserved for administrators, directly threatening the financial integrity of online stores. Active exploitation in the wild means that unpatched sites are already being targeted, not just theoretically at risk. The root failure is twofold: the module shipped without adequate authorization enforcement, and site operators failed to apply the patch before attackers weaponized the vulnerability.",[141,142,143,144,145,146,147],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":149,"PCI DSS Requirement 6":150,"NIST SP 800-53 SI-2: Flaw Remediation":151,"OWASP A06:2021 Vulnerable and Outdated Components":152,"CIS Control 7: Continuous Vulnerability Management":153,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":154,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":155},"NIS2 requires essential and important entities to implement vulnerability handling and patching policies; operators of commercial e-commerce platforms failing to patch a critical authorization flaw would breach this obligation.","For stores processing card payments, PCI DSS Requirement 6 mandates secure development and timely patching of payment-related software, making this Drupal Commerce vulnerability a direct compliance concern.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; a defined remediation SLA for critical flaws would have driven faster patching of this actively exploited vulnerability.","This incident is a textbook A06 scenario where a known vulnerable component (Commerce Core) remained in production, enabling attackers to exploit a publicly disclosed authorization flaw.","Regular, automated scanning of the Drupal environment would have flagged CVE-2026-118539 upon publication, enabling patching before active exploitation began.","A.8.8 requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, directly mandating the patch application process that was delayed here.","The core failure was missing authorization checks; PR.AA mandates that access to resources be managed and enforced consistently, which would have caught this design gap in code review or runtime controls."]