Serial number: AV26-1105
Date: October 30, 2026
As of October 28, 2026, Drupal is affected by a vulnerability in the following product:
- Commerce Core
- Versions prior to 2.41 and 3.0.0 versions prior to 3.3.13
Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.