Cyber News / Article / Drupal Commerce Core Vulnerability Exploited Against Online Stores
Drupal Commerce Core Vulnerability Exploited Against Online Stores
Hi, what are you looking for?
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
By
Drupal is urging online store owners to patch a highly critical access bypass vulnerability in the Commerce Core module, warning that it is being exploited in the wild.Tracked asCVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process. Drupal’s statistics show themoduleis used on more than 42,000 sites.“The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor,” Drupal explains in its advisory.The Drupal security team gave the issue a risk score of 21 out of 25. According to the score, unauthenticated attackers can exploit the flaw no matter how the module is set up.Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted. It has also not said whether the vulnerability was exploited as a zero-day, before patches became available.The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.Advertisement. Scroll to continue reading.“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Tracked asCVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process. Drupal’s statistics show themoduleis used on more than 42,000 sites.“The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor,” Drupal explains in its advisory.The Drupal security team gave the issue a risk score of 21 out of 25. According to the score, unauthenticated attackers can exploit the flaw no matter how the module is set up.Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted. It has also not said whether the vulnerability was exploited as a zero-day, before patches became available.The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.Advertisement. Scroll to continue reading.“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
“The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor,” Drupal explains in its advisory.The Drupal security team gave the issue a risk score of 21 out of 25. According to the score, unauthenticated attackers can exploit the flaw no matter how the module is set up.Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted. It has also not said whether the vulnerability was exploited as a zero-day, before patches became available.The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.Advertisement. Scroll to continue reading.“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
The Drupal security team gave the issue a risk score of 21 out of 25. According to the score, unauthenticated attackers can exploit the flaw no matter how the module is set up.Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted. It has also not said whether the vulnerability was exploited as a zero-day, before patches became available.The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.Advertisement. Scroll to continue reading.“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted. It has also not said whether the vulnerability was exploited as a zero-day, before patches became available.The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.Advertisement. Scroll to continue reading.“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.Advertisement. Scroll to continue reading.“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
The 38 otheradvisoriesDrupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
TheCAPTCHAmodule also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
On October 14, Drupal announced fixes for twocritical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, didattract exploitation attemptsin May.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Barracuda has appointed Dan Fletcher as CFO.
Artemis Security has appointed Arun Singh as CGO.
General Paul M. Nakasone has joined Armadin’s Board of Directors.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Got a confidential news tip? We want to hear from you.
Reach a large audience of enterprise cybersecurity professionals
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.
Related articles
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
6 days ago
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
6 days ago
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
7 days ago
