CVE-2026-118539: A Drupal shop module flaw is being used to place orders for one cent

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

A Drupal shop module flaw is being used to place orders for one cent

Drupal confirms active exploitation of a critical flaw in Commerce Core, used by more than 42,000 sites. Here are the versions to install and four checks to run on your recent orders.

Nov 1, 20263 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)