# CVE-2026-16641: Drupal Commerce Elavon payment module unsupported due to unpatched security vulnerability

Source: https://junglewise.ai/threats/cve-2026-16641-drupal-commerce-elavon-payment-module-unsupported-due-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16641 · Severity: critical · CVSS 9.8 · Published 2026-08-25

Commerce Elavon is a Drupal module that integrates payment processing for the Elavon Virtual Merchant gateway, handling credit card transactions and payment authorization. The maintainers have ceased development and failed to fix a critical security vulnerability, rendering the module unsupported and potentially exposing sites to compromise. Any Drupal site running this module is advised to uninstall it immediately or seek alternative payment solutions.

Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-16641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16641 being exploited in the wild.

**How severe is CVE-2026-16641?** Critical severity, with a CVSS score of 9.8, published 25 August 2026.

**Which products and versions are affected?** Drupal Commerce Elavon all versions; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Elavon ECOSYSTEM:introduced=0.

**Is there a fix for CVE-2026-16641?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16641 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16641?** Check whether you run Drupal Commerce Elavon or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Elavon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The exact technical nature of the vulnerability is not disclosed in the advisory, but the Drupal security team has marked the Commerce Elavon module as unsupported and critical due to a known security issue that remains unpatched. The module handles sensitive payment card processing and authorization workflows, making any unpatched vulnerability in this context high-risk. No patch is available, and the maintainer has abandoned the project. The attack vector and specific exploitation path are not detailed, but the criticality rating suggests remote exploitation may be possible. Sites must either uninstall the module, seek alternative maintained payment solutions, or hire external developers to fix the vulnerability.

## Affected products

- Drupal Commerce Elavon all versions

## Identifiers

- CVE-2026-16641
- DRUPAL-CONTRIB-2026-084

## Timeline

- 2026-07-22: disclosed: Marked unsupported by Drupal security team
- 2026-08-25: advisory: NVD entry published

## References

- [https://www.drupal.org/project/commerce_elavon](https://www.drupal.org/project/commerce_elavon)
- [https://www.drupal.org/sa-contrib-2026-084](https://www.drupal.org/sa-contrib-2026-084)

## Related threats

- [DRUPAL-CONTRIB-2022-053 - This module enables you to accept payments from the Elavon payment provider. The module…](https://junglewise.ai/threats/drupal-contrib-2022-053-this-module-enables-you-to-accept-payments-from-d4532808)