Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Threat actors are actively exploiting a critical missing authorization vulnerability in Drupal Commerce Core, tracked as CVE-2026-118539, which affects versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. This flaw fails to protect specific routes and entity fields, allowing unauthorized access that poses severe financial risks to vendors. Additionally, separate critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are experiencing widespread exploitation attempts utilizing public proof-of-concept exploits and local file inclusion vectors.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module discovers web services running on open ports and analyzes application response headers or exposed files to identify vulnerable versions of frameworks like Drupal and PHP exposed to the internet.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain