Attackers exploit critical Drupal Commerce Core flaw CVE-2026-118539
Missing checks on routes and entity fields affect Commerce Core through 2.41 and 3.3.13 and may cost vendors money.
78
Vendor
Drupal
- Mentions · 7d6
- Mentions · 30d16
- All mentions18
- First seenAug 19, 2026
- Last mentioned14h ago
Timeline
18 articles · newest firstDrupal Commerce Core access bypass reported exploited in the wild
Releases before 2.41 and 3.0.0 before 3.3.13 are affected; Drupal rates the issue highly critical.
74
Drupal Commerce access bypass exploited in the wild (CVE-2026-118539)
Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.
76
Drupal Commerce Core access bypass exploited against online stores
Unauthenticated attackers can hit the flaw on more than 42,000 sites; fixed releases are 3.3.13 and 8.x-2.41.
76
Drupal Commerce Core access bypass exploited in attacks
Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.
78
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
74
Drupal Field UI flaw can allow unauthenticated takeover (CVE-2026-108097)
Core alone is not directly exploitable, but contributed modules or custom code can open unauthenticated paths; no public exploit is reported.
64
Drupal patches two critical RCE flaws and XSS bugs
Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19, plus Entity List 3.0.10; Field UI can be uninstalled.
74
Drupal patches critical RCEs CVE-2026-108097 and CVE-2026-108099
The captured page gives no affected versions, fixed releases, or statement on exploitation.
46
Drupal warns of critical Field UI RCE in core (CVE-2026-108097)
Core alone is not directly exploitable, but at least one contributed-module path needs no login.
64
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical remote code execution flaws and warned exploits could appear within hours or days.
82
Drupal security advisory (AV26-1047)
Canada's Cyber Centre warns of critical remote code execution in unpatched Drupal core releases.
67
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.
74
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Drupal core Navigation module has a permission-gated XSS flaw tracked as CVE-2026-108514.
40
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Drupal core Link module XSS CVE-2026-108515 is moderately critical; 11.4.x should update to 11.4.10.
44
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Drupal warns of critical Field UI remote code execution, CVE-2026-108097, including an unauthenticated contributed-module path.
73
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
Drupal issues moderately critical advisory for XSS in bundled CKEditor affecting content editors; fixed versions released, exploitation theoretical.
32
Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices
Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.
32
Related CVEs
by mentions- CVE-2026-108097<1%—Unauthenticated RCE via unsafe reflection in Drupal core
- Missing authorization in Drupal Commerce Core
- Unsafe reflection in Drupal Entity List through 3.0.10
- Cross-site scripting in Drupal core
- Cross-site scripting in Drupal core
- CVE-2019-2725100%9.8Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Field UIproduct · 6
- Commerce Coreproduct · 6
- Drupal coreproduct · 5
- Drupalorganization · 4
- Drupal Security Teamorganization · 3
- Entity Listproduct · 3
- Canadian Centre for Cyber Securityorganization · 2
- Drupalproduct · 2
- WordPressproduct · 1
- Wizorganization · 1
- Pantheonorganization · 1
- WebLogicproduct · 1
- GPON routersproduct · 1
- Oraclevendor · 1
- Navigationproduct · 1
- DD-WRTproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.