type: cve · created: 2026-10-31 · updated: 2026-10-31 · tags: [cve] · confidence: medium · severity: medium · affected_sectors: [global] · au_impact: false
Drupal has warned administrators to patch a critical access bypass in its Commerce Core module — tracked as CVE-2026-118539 — that unauthenticated attackers are exploiting in the wild.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-118539 |
| CVSS | 6.5 (MEDIUM) |
| Vendor / product | Not stated |
| Reported | 2026-10-31 |