Drupal warns of critical Commerce Core flaw exploited in attacks

CVE v události 1

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.

Tahle CVE jsem vytáhl z širšího textu článku: CVE-2026-108097, CVE-2026-108099, CVE-2026-9082. Neukazuju u nich proto fakta z katalogů výše, a to preventivně, protože článek se na ně mohl jen odkazovat, třeba jako na starší kauzu.

Jak se o tom psalo 3

1. 30. 10. 2026 16:43 · Cyber Centre Kanada CA

   Drupal security advisory (AV26-1105)

   Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to 2.41 and 3.0.0 versions prior to 3.3.13 Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Commerce Core - Highly critical - Access bypass - SA-CONTRIB…

2. 30. 10. 2026 11:16 · BleepingComputer US nadpis události

   Drupal warns of critical Commerce Core flaw exploited in attacks

   Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. [...]

3. 29. 10. 2026 · zachyceno 04:30 · NCSC-FI FI

   Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

   Classification: Critical, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: None, CVEs: CVE-2026-118539, Summary: Project: Commerce Core Project machine name: commerce Date: 2026-October-28 Security risk: Highly critical 21 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All Vulnerability: Access bypass Affected versions: =3.0.0