CVE-2026-118564: Commerce payumoney · The Drupal Security Team is marking this project unsupported
Affects drupal/commerce_payumoneySource GCVE Database
Not known to be exploited · end of life, no fix coming : replace or isolate drupal/commerce_payumoney; no fix will be released.
Data as of 28 Oct 2026, 20:42 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Patch
- None coming – the product is end of life
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
No fix will be released: drupal/commerce_payumoney is end of life. Replace it, or isolate it from untrusted networks until you can.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagist https //packages.drupal.org/8drupal/commerce_payumoney | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
If continued use is necessary, users may consider taking over maintenance following the Drupal Security Team's guidance to address the security issues.
Description
The Drupal Security Team has marked the commerce_payumoney project as unsupported due to an unresolved security issue. The maintainer has not fixed the known vulnerability, and the project is no longer supported for security reasons.