[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdAw2ZzEz1ty_aM2NufJ_QtL09AgQAZJYtToYnjIPN_Q":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"41e536a2-4cb3-4a20-8977-11d5a4621bcb","Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01","critical-drupal-commerce-vulnerability-could-let-hackers-buy-products-for-just-0-0b1a09","Drupal has warned that hackers are actively exploiting a highly critical security flaw in Commerce Core, putting online stores at risk of financial losses. Tracked as CVE-2026-118539, the vulnerability lets attackers bypass access checks in the module used to sell products and services on Drupal websites and connected shopping applications. The warning raises concerns about […] The post Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01 appeared first on Cyber Security News.","Drupal has disclosed a highly critical vulnerability (CVE-2026-118539) in Commerce Core that allows attackers to bypass access checks on routes and entity fields, potentially enabling unauthorized price manipulation and financial losses for online stores. The flaw affects Commerce Core versions before 2.41 and 3.0.0 through 3.3.12, with active exploitation already confirmed. Drupal advises immediate patching and auditing of orders for inconsistencies to detect potential exploitation.","Critical Drupal Commerce vulnerability (CVE-2026-118539) allows attackers to bypass access checks and manipulate","https:\u002F\u002Fcybersecuritynews.com\u002Fcritical-drupal-commerce-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FCritical-Drupal-Commerce-Vulnerability-Could-Let-Hackers-Buy-Products-for-Just-0.01.webp","2026-10-30T13:56:01+00:00","2026-10-30T14:00:17.471951+00:00",9,[17,20,23],{"name":18,"type":19},"Drupal Commerce Core","product",{"name":21,"type":22},"Drupal","vendor",{"name":21,"type":24},"technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[47],{"type":48,"value":49,"context":50},"cve","CVE-2026-118539","Critical vulnerability in Drupal Commerce Core allowing access control bypass",[21,18],{"controls":53,"vendors":137},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":84,"product_name":105,"url":106,"description":107},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":109,"name":110,"problem":111,"products":112},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"critical-drupal-commerce-flaw-lets-attackers-buy-products-for-001","Critical Drupal Commerce Flaw Lets Attackers Buy Products for $0.01","A critical vulnerability in Drupal's Commerce Core module allows attackers to bypass access controls on routes and entity fields, enabling them to manipulate product prices to near-zero values and cause direct financial harm to online retailers. The flaw is already being actively exploited in the wild, meaning every day without patching increases exposure to real monetary losses. This incident highlights the danger of delayed patching in e-commerce environments where application-layer vulnerabilities have immediate, quantifiable business impact. Organizations running Drupal Commerce must treat critical CMS vulnerabilities with the same urgency as infrastructure-level flaws, given the direct path from exploitation to financial damage.",[143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":151,"PCI DSS Requirement 6":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"OWASP A06:2021 Vulnerable and Outdated Components":154,"CIS Control 7: Continuous Vulnerability Management":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures; online retailers subject to NIS2 must have processes to detect and patch actively exploited vulnerabilities like this one without delay.","PCI DSS Requirement 6 requires merchants to develop and maintain secure systems by patching known vulnerabilities promptly; an e-commerce platform processing card payments is directly in scope and must address this critical flaw immediately.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; applying the Drupal Commerce patch within an emergency timeframe directly satisfies this control.","This vulnerability is a textbook example of running an outdated third-party component (Commerce Core) with a known critical flaw, which OWASP A06 specifically warns organizations to prevent through inventory management and timely upgrades.","Regular vulnerability scanning and a defined patching timeline would have identified CVE-2026-118539 in Drupal Commerce before active exploitation began, closing the window of exposure.","This control mandates timely identification and remediation of technical vulnerabilities in software assets, which would have driven the organization to patch Commerce Core before attackers exploited it.","The vulnerability allows bypass of access checks on routes and entity fields; strong access control validation aligned with PR.AA would have mitigated the impact of the flaw even before a patch was available."]