Drupal ma'murlarni Commerce Core modulidagi tanqidiy kirish chetlab o'tish zaifligini tuzatishga chaqirdi, bu zaiflik hujumchilari tomonidan faol foydalanilmoqda.
CVE-2026-118539 sifatida kuzatilgan bu zaiflik yetishmayotgan avtorizatsiya zaifligidan kelib chiqadi, uni autentifikatsiyadan o'tmagan hujumchilar suiiste'mol qilishi mumkin va u Commerce Core 0.0.0 dan 2.41 gacha va 3.0.0 dan 3.3.13 gacha versiyalariga ta'sir qiladi.
Drupal xavfsizlik jamoasi 3.x tarmog'idagi ma'murlardan darhol Commerce Core 3.3.13 ga (yoki avvalgi versiyalar uchun Commerce Core 8.x-2.41 ga) yangilashni va buyurtmalarni nomuvofiqliklar uchun tekshirishni so'radi, chunki tahdid aktorlari bu zaiflikni hujumlarda foydalanmoqda.
"Bu modul sizga tovarlar va xizmatlarni mijozlarga kiritilgan savat va to'lov shakli orqali yoki API'lar orqali ajratilgan ilovalar yordamida sotish imkonini beradi," deb aytdi Drupal chorshanba kuni e'lon qilingan va yuqori tanqidiy deb belgilangan maslahatda.
"Modul ma'lum yo'nalishlar va obyekt maydonlarini yetarlicha himoya qilmaydi, bu esa kirish chetlab o'tishga olib keladi va sotuvchiga moliyaviy ta'sir ko'rsatishi mumkin. Bu zaiflik faol ravishda foydalanilmoqda."
Commerce Core — bu 42 000 dan ortiq veb-saytlar tomonidan ishlatiladigan jamoaviy ishlab chiqilgan Drupal moduli, jumladan Fortune 500 kompaniyalari va tadqiqot universitetlari kabi ko'plab yuqori darajali tashkilotlar.
Modul Drupal Kontentni Boshqarish Tizimi (CMS) ustida elektron tijorat saytlari va savdo ilovalarini qurish va ishlatish uchun dasturiy ta'minot ramkasini taqdim etadi.
May oyida Drupal shuningdek, hujumchilar ma'lumotlar bazasi abstraksiya API'dagi SQL in'ektsiya zaifligini (CVE-2026-9082) foydalanayotganini ogohlantirdi, bu esa imtiyozlar oshirish, ma'lumotlar oshkor bo'lishi va masofaviy kod bajarilishiga olib kelishi mumkin.
Bir necha kun o'tib, AQSh Kiberxavfsizlik va Infratuzilma Xavfsizlik Agentligi (CISA) bu zaiflikni o'zining Ma'lum Foydalanilgan Zaifliklar (KEV) Katalogiga qo'shdi va federal agentliklarga tizimlarini uch kun ichida tuzatishni buyurdi.
Ikki hafta oldin Drupal yana ikkita masofaviy kod bajarish xavfsizlik muammosini (CVE-2026-108097 va CVE-2026-108099) tuzatdi, bu tahdid aktorlariga kodni masofadan bajarish imkonini berishi mumkin, va ma'murlarga yangilanishlarni iloji boricha tezroq qo'llashni tavsiya qildi, chunki hujumchilar "soatlar yoki kunlar ichida" eksploitlar ishlab chiqishi mumkin.
So'nggi bir necha yil ichida CISA faol foydalanilayotgan 5 ta Drupal zaifligini belgiladi, ulardan ikkitasi shuningdek ransomware to'dalari tomonidan suiiste'mol qilingan.
Hujumchilar haqiqiy hisob ma'lumotlariga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi.
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hisob ma'lumotlaridan foydalanganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
Tracked as CVE-2026-118539, this flaw stems from a missing authorization weakness that can be abused by unauthenticated attackers and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
The Drupal security team asked admins on the 3.x branch to upgrade immediately to Commerce Core 3.3.13 (or Commerce Core 8.x-2.41 for earlier versions) and audit orders for inconsistencies, since threat actors are exploiting this vulnerability in attacks.
"This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in a Wednesday advisory tagged as highly critical.
"The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild."
Commerce Core is a community-developed Drupal module used by more than 42,000 websites, including many high-profile organizations such as Fortune 500 companies and research universities.
The module provides a software framework for building and running e-commerce sites and shopping apps on top of the Drupal Content Management System (CMS).
In May, Drupal also warned that attackers were exploiting an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API that could lead to privilege escalation, information disclosure, and remote code execution.
Days later, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch their systems within three days.
Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon as possible because attackers could develop exploits "within hours or days."
Over the last several years, CISA has flagged 5 Drupal vulnerabilities exploited in the wild, two of which have also been abused by ransomware gangs.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report