Attackers exploit critical Drupal Commerce Core flaw CVE-2026-118539
Missing checks on routes and entity fields affect Commerce Core through 2.41 and 3.3.13 and may cost vendors money.
1
Stories per day · 30 days
3 RSS
Relatedcommerce-core6rce6field-ui5access-bypass4cms4php4remote-code-execution4advisory3cve-2026-1080973drupal-core3ecommerce3patch3php2shell3wordpress3xss3e-commerce2entity-list2sa-core2
19 stories, newest first · one card per story
Stories tagged #drupal
Drupal Commerce Core access bypass reported exploited in the wild
Releases before 2.41 and 3.0.0 before 3.3.13 are affected; Drupal rates the issue highly critical.
1
Drupal Commerce access bypass exploited in the wild (CVE-2026-118539)
Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.
1
Drupal Commerce Core access bypass exploited against online stores
Unauthenticated attackers can hit the flaw on more than 42,000 sites; fixed releases are 3.3.13 and 8.x-2.41.
1
Drupal Commerce Core access bypass exploited in attacks
Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.
1
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
1
Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report
Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
PHP to release two emergency 9.2-severity patches
watchTowr says CVE-2026-109618 and CVE-2026-109619 are real; maintainers have not confirmed active exploitation.
Drupal Field UI flaw can allow unauthenticated takeover (CVE-2026-108097)
Core alone is not directly exploitable, but contributed modules or custom code can open unauthenticated paths; no public exploit is reported.
Drupal patches two critical RCE flaws and XSS bugs
Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19, plus Entity List 3.0.10; Field UI can be uninstalled.
1
Drupal patches critical RCEs CVE-2026-108097 and CVE-2026-108099
The captured page gives no affected versions, fixed releases, or statement on exploitation.
Drupal warns of critical Field UI RCE in core (CVE-2026-108097)
Core alone is not directly exploitable, but at least one contributed-module path needs no login.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical remote code execution flaws and warned exploits could appear within hours or days.
Drupal security advisory (AV26-1047)
Canada's Cyber Centre warns of critical remote code execution in unpatched Drupal core releases.
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Drupal core Link module XSS CVE-2026-108515 is moderately critical; 11.4.x should update to 11.4.10.
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Drupal warns of critical Field UI remote code execution, CVE-2026-108097, including an unauthenticated contributed-module path.
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
Drupal issues moderately critical advisory for XSS in bundled CKEditor affecting content editors; fixed versions released, exploitation theoretical.