Is CVE-2026-126742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126742 being exploited in the wild.

How severe is CVE-2026-126742?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal Commerce sermepa <2.5.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa ECOSYSTEM:introduced=0,fixed=2.5.0.

Is there a fix for CVE-2026-126742?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa: upgrade to 2.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126742 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126742?

Check whether you run Drupal Commerce sermepa or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126742: Drupal Commerce sermepa payment verification bypass

Q: Is there a fix for CVE-2026-126742?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa: upgrade to 2.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126742 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126742?

Check whether you run Drupal Commerce sermepa or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126742 · Severity: info · Published 2026-11-11

The Commerce sermepa module handles payment processing for Spanish Redsys/Sermepa banking systems within Drupal-based e-commerce stores. The module fails to verify that payment responses are matched to the correct order, allowing attackers to manipulate order payment statuses and potentially mark unauthorized transactions as paid.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126742 being exploited in the wild.
How severe is CVE-2026-126742?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Commerce sermepa <2.5.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa ECOSYSTEM:introduced=0,fixed=2.5.0.
Is there a fix for CVE-2026-126742?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa: upgrade to 2.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126742 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126742?: Check whether you run Drupal Commerce sermepa or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Sermepa: upgrade to 2.5.0 or later

Technical details

The Commerce sermepa module does not validate that incoming Redsys payment responses are associated with the order they purport to be processed for. This lack of order-to-response verification allows an attacker to submit payment callbacks for arbitrary orders, leading to incorrect payment status updates. The vulnerability requires network access to submit crafted payment responses but no authentication or user interaction.

Affected products

Drupal Commerce sermepa <2.5.0

Identifiers

CVE-2026-126742
DRUPAL-CONTRIB-2026-333

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.