Attackers Exploit Drupal Commerce, Ivanti Connect Secure and Synology DSM Flaws
Attackers are actively exploiting vulnerabilities in Drupal Commerce Core, Ivanti Connect Secure and Synology DSM, according to a report published by Heise on November 2. The attacks are already compromising systems, and the affected vendors or security authorities have issued warnings or updates.
The Drupal Commerce flaw allows attackers to bypass access restrictions. The Drupal team said the module does not adequately protect certain routes and entity fields, which can give attackers access that has financial consequences for a seller. The vulnerable component supports checkout-based stores and headless applications using an API, according to the report.
The Drupal project said administrators should update Commerce Core to version 3.3.13, or to version 8.x-2.41 or later for the older development branch. It also advised administrators to check orders for inconsistencies because the attacks are ongoing.
Ivanti Connect Secure appliances are also under attack, according to the US Cybersecurity and Infrastructure Security Agency and the report. Volexity's analysis indicates that the attacks began in early October. Ivanti said attackers are chaining three vulnerabilities to bypass authentication, escalate privileges and upload and execute malicious code from the network.
Ivanti patched CVE-2026-104935, an authentication-bypass flaw rated high risk with a CVSS score of 8.6. The company later issued updated packages for CVE-2026-111357, which allows privilege escalation through an unauthenticated critical function, and CVE-2026-118527, which can let authenticated attackers upload files with their own contents to a known path. Ivanti recommends regularly running its Integrity Checker Tool to look for indicators of compromise and points administrators to Volexity's analysis.
Synology warned shortly before the weekend that ransomware groups are targeting outdated DSM versions without fixes for vulnerabilities disclosed at Pwn2Own in October 2024. Synology patched those flaws in December 2024. The attackers encrypt data and demand a ransom, according to the report. Synology users should update to newer firmware if they have not already done so.