CVE-2026-118539 – Security Blog https://blog.siteguarding.com Sat, 31 Oct 2026 08:33:07 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.3 https://blog.siteguarding.com/wp-content/uploads/2016/07/cropped-Logo_sh_last_2_last-32x32.jpg CVE-2026-118539 – Security Blog https://blog.siteguarding.com 32 32 Drupal Commerce Core CVE-2026-118539: A Core Update Won’t Save You https://www.siteguarding.com/security-blog/drupal-commerce-core-cve-2026-118539/ Sat, 31 Oct 2026 08:33:07 +0000 https://www.siteguarding.com/security-blog/drupal-commerce-core-cve-2026-118539/ Drupal says CVE-2026-118539, a highly critical access-bypass flaw in Drupal Commerce Core, is being actively exploited in the wild. Updating Drupal core leaves this module untouched. The advisory's version numbers also need a careful second read before you call your shop patched. Key takeaways If your store’s cart, checkout or product catalog is built on Drupal, it almost certainly runs Commerce...

Source

]]> Drupal Commerce Access Bypass Under Attack: Patch and Audit https://www.siteguarding.com/security-blog/drupal-commerce-access-bypass-store-fix/ Sat, 31 Oct 2026 08:18:28 +0000 https://www.siteguarding.com/security-blog/drupal-commerce-access-bypass-store-fix/ Drupal has confirmed active exploitation of CVE-2026-118539, a highly critical Drupal Commerce access bypass that lets requests reach store routes and data they should never touch. Updating the module closes the hole, but you also need to check whether anyone changed your orders, prices or checkout settings while it was open. Key takeaways CVE-2026-118539 is a missing-authorization flaw in Drupal...

Source

]]>