What is the CVSS score of CVE-2026-0750?

CVE-2026-0750 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Commerce Paybox are affected by CVE-2026-0750?

A critical cryptographic signature verification flaw in Commerce Paybox (versions up to 7.X-1.5) allows attackers to bypass payment authentication controls, potentially enabling unauthorized…

Is there a public PoC exploit available for CVE-2026-0750?

Yes, a public proof-of-concept exploit is available for CVE-2026-0750. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-0750?

Within 24 hours: Inventory all Commerce Paybox instances and versions in production; isolate or disable payment processing on affected systems if possible. Within 7 days: Implement network segmentation to restrict Paybox access to trusted internal networks only; enable enhanced transaction monitoring and alerting for anomalous payment activity. Within 30 days: Upgrade to patched version when available; conduct full payment transaction audit for the period of vulnerability exposure; notify affected customers of potential compromise.

Commerce Paybox CVE-2026-0750

HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-01-28 mlhess@drupal.org

Drupal Authentication Bypass Commerce Paybox

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Mar 09, 2026 - 14:38 vuln.today

Public exploit code

CVE Published

Jan 28, 2026 - 19:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.

AnalysisAI

Commerce Paybox versions up to 7.X-1.5. is affected by improper verification of cryptographic signature (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-347: Improper Verification of Cryptographic Signature) affects Commerce Paybox. Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.