Drupal onlayn do'kon egalarini Commerce Core modulidagi yuqori darajada kritik ruxsatni chetlab o'tish zaifligini tuzatishga chaqirmoqda va bu zaiflik yovvoyi tabiatda ekspluatatsiya qilinayotganini ogohlantirmoqda.
CVE-2026-118539 sifatida kuzatilgan bu muammo Drupal veb-saytlariga elektron tijorat funksiyalarini, jumladan savdo savatchasi va to'lov jarayonini qo'shadigan qo'shimcha modulga ta'sir qiladi. Drupal statistikasi modul 42 000 dan ortiq saytda ishlatilishini ko'rsatadi.
"Modul ma'lum marshrutlar va obyekt maydonlarini yetarlicha himoya qilmaydi, bu esa sotuvchiga moliyaviy ta'sir ko'rsatishi mumkin bo'lgan ruxsatni chetlab o'tishga olib keladi", deb tushuntiradi Drupal o'z maslahatida.
Drupal xavfsizlik jamoasi muammoga 25 dan 21 ballik xavf bahosini berdi. Bahoga ko'ra, autentifikatsiyalanmagan hujumchilar modul qanday sozlanganidan qat'i nazar zaiflikni ekspluatatsiya qilishlari mumkin.
Drupal hujumlarni tasdiqladi, ammo xato qanday ekspluatatsiya qilinayotgani, faoliyat ortida kim turgani yoki qancha sayt nishonga olingani haqida ma'lumot bermadi. Shuningdek, zaiflik nol kun (zero-day) sifatida, tuzatishlar mavjud bo'lishidan oldin ekspluatatsiya qilinganmi yoki yo'qmi, bu ham aytilmadi.
Zaiflik 3.3.13 dan oldingi 3.x versiyalari va 8.x-2.41 dan oldingi oldingi relizlarga ta'sir qiladi. Administratorlar ikkita tuzatilgan versiyadan biriga yangilanishi va do'kon buyurtmalarini tekshirishi kerak.
"Bu zaiflik faol ravishda ekspluatatsiya qilinayotgani sababli saytlar buyurtmalarni nomuvofiqliklar uchun tekshirishi kerak", deb o'qiladi maslahat.
28-oktabrda Drupal e'lon qilgan boshqa 38 ta maslahat 21 ta qo'shimcha loyihalardagi zaifliklarni qamrab oladi. Deyarli o'nlablari kritik deb baholangan, jumladan masofadan kod bajarish, hisobni egallab olish yoki Commerce buyurtmalarining Stripe orqali to'lovsiz to'langan deb belgilanishiga olib kelishi mumkin bo'lgan xatolar.
CAPTCHA moduli ham o'rtacha darajada kritik xato uchun tuzatish oldi, bu esa himoyalangan shaklni yangi chaqiruvni yechmasdan qayta yuborishga imkon beradi. Drupal bahosi bu xato uchun ekspluatatsiya kodi yovvoyi tabiatda mavjudligini ko'rsatadi, garchi maslahat faol ekspluatatsiya haqida eslatmasa ham.
Drupal baholari shuningdek, Commerce Core va Media Alias Display modullaridagi ikkita ma'lumot oshkor qilish xatosi uchun isbot-konseptlar (proofs of concept) mavjudligini ko'rsatadi.
14-oktabrda Drupal ikkita kritik masofadan kod bajarish xatosi — Drupal yadrosining Field UI modulidagi CVE-2026-108097 va Entity List modulidagi CVE-2026-108099 — uchun tuzatishlar e'lon qildi. Ikkala komponent ham o'z-o'zidan zaiflikni ochib bermaydi, ammo ba'zi boshqa qo'shimcha modullar yoki maxsus kod ekspluatatsiyani mumkin qiladi, ba'zi hollarda autentifikatsiyasiz.
14-oktabrdagi xavfsizlik relizlaridan oldin Drupal ekspluatatsiyalar soatlar yoki kunlar ichida paydo bo'lishi mumkinligi haqida ogohlantirgan edi. Hozirgacha esa bu zaifliklarning yovvoyi tabiatda ekspluatatsiya qilingani haqida ommaviy hisobotlar bo'lmadi.
Drupal yadrosining ma'lumotlar bazasi abstraksiya API-sidagi yuqori darajada kritik SQL in'ektsiya muammosi — PostgreSQL asosidagi saytlarga ta'sir qiluvchi CVE-2026-9082 — may oyida ekspluatatsiya urinishlarini jalb qilgan edi.
Bog'liq: Maksimal darajadagi GitLab zaifligi Alpine Linuxga qarshi ekspluatatsiya qilinmoqda
Bog'liq: Cisco SD-WAN nol kun ekspluatatsiyasi Volt Typhoonning "Silent Train" tarmog'iga bog'langan
Bog'liq: Hujumchilar avgustdan beri ikkinchi Cisco Firewall VPN nol kunini ekspluatatsiya qilmoqda
Bog'liq: Xitoylik xakerlar past darajadagi ESXi jurnalga yozish xatosini nol kun sifatida jimgina ishlatishdi
Drupal is urging online store owners to patch a highly critical access bypass vulnerability in the Commerce Core module, warning that it is being exploited in the wild.
Tracked as CVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process. Drupal’s statistics show the module is used on more than 42,000 sites.
“The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor,” Drupal explains in its advisory.
The Drupal security team gave the issue a risk score of 21 out of 25. According to the score, unauthenticated attackers can exploit the flaw no matter how the module is set up.
Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted. It has also not said whether the vulnerability was exploited as a zero-day, before patches became available.
The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.
“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.
The 38 other advisories Drupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.
The CAPTCHA module also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.
Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.
On October 14, Drupal announced fixes for two critical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.
Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.
CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, did attract exploitation attempts in May.
Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day