EUVD-2026-66206
GHSA-x2xm-563p-wrqw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal site running Commerce Elavon
-
DeliverySend crafted request to payment endpoint
-
ExploitBypass improper input validation
-
ExecutionTrigger unintended data handling
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | The target must be a Drupal site with the Commerce Elavon contrib module installed and its Elavon payment method enabled and reachable - i.e., an operational checkout/payment path is the attack surface. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is described as remotely reachable without authentication or user interaction against such a deployment. Limiting factors: exploitation is confined to installations that actually use this specific contrib module (not Drupal core and not other payment gateways), the precise vulnerable versions are unstated so the condition set cannot be narrowed further, and with EPSS at the 4th percentile and no POC, real-world exploitability of the exact input path is unconfirmed. |
| Impact | The signals here conflict and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a trivially exploitable, fully-impacting remote flaw, but three independent signals temper that: the EPSS probability is only 0.14% (4th percentile), the CVE is not on the CISA KEV list, and no POC is referenced - so there is no evidence of active or imminent exploitation. There is also an internal inconsistency: the vendor tag classifies this strictly as 'Information Disclosure,' which is hard to reconcile with the I:H/A:H integrity/availability impacts baked into the 9.8 score; the high CVSS appears to be a conservative or auto-generated maximal scoring rather than a validated confidentiality-only assessment - verify with the Drupal advisory. Net judgment: for sites actually running Commerce Elavon this warrants prompt patching because it is a payment component, but the low EPSS/absent-KEV picture argues this is a patch-in-normal-cycle priority, not an emergency, and the true impact is most plausibly data exposure rather than RCE. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request containing malformed or unexpected input to the Commerce Elavon module's payment-handling endpoint on a Drupal store, exploiting the missing input validation to trigger disclosure of sensitive data or unintended application behavior. The CVSS AV:N/AC:L/PR:N/UI:N vector implies this needs no authentication, no user interaction, and low complexity, but no public POC currently exists to confirm the exact request shape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. No public exploit identified at time of analysis, and the EPSS score sits in the 4th percentile, indicating little observed exploitation interest despite the headline 9.8 rating.
RemediationAI
Consult Drupal advisory SA-CONTRIB-2026-084 (https://www.drupal.org/sa-contrib-2026-084) and upgrade the Commerce Elavon module to the fixed release it names; a specific fixed version was not provided in this data set, so do not assume a version number - treat the advisory's designated release as authoritative (Patch available per vendor advisory). Because the affected range is published only as '*.*', apply the update on all sites regardless of current version. If the fixed release cannot be deployed immediately, reduce exposure by restricting or temporarily disabling the Elavon payment method in the Commerce configuration (trade-off: card payments through Elavon stop working) and by placing the checkout/payment-callback endpoints behind a WAF rule or IP restriction that filters malformed input to the affected parameters (trade-off: may block legitimate gateway callbacks if the allowlist is too narrow). Monitor Drupal logs for anomalous requests to the module's payment routes until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Commerce Elavon is a contributed Drupal Commerce module that integrates a Drupal storefront with Elavon's (Converge/Fusebox) card-payment gateway, handling checkout, tokenization, and transaction API calls. The CPE cpe:2.3:a:drupal:commerce_elavon:*:*:*:*:*:*:*:* confirms the affected component is the Drupal contrib application itself, not Drupal core. The assigned weakness, CWE-20 (Improper Input Validation), describes a root cause in which the module accepts data - likely a request parameter, gateway callback, or API response field - without adequately constraining its type, format, or value, allowing an attacker to steer logic in unintended ways. The 'Information Disclosure' tag suggests the practical consequence is exposure of sensitive data (potentially payment or configuration data) rather than the full compromise implied by the CVSS impact triplet.
Know when Commerce Elavon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, low-complexity, unauthenticated per NVD vector, but the 'Information Disclosure' tag supports C:H with I:N/A:N rather than the input's full I:H/A:H triplet.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
Executive ViewAI
Drupal Commerce merchants using the Elavon payment-gateway module face a critical information disclosure vulnerability (CVE-2026-16641, CVSS 9.8) affecting all published versions, allowing unauthenticated remote attackers to access sensitive payment data through improper input validation. No patch currently exists, and while exploitation likelihood remains low (EPSS 0.1%), this creates immediate regulatory compliance and customer data protection risks. Organizations must inventory affected installations and implement interim controls immediately.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to payment processing endpoints via firewall rules and network segmentation; deploy WAF signature-based blocking for exploitation patterns targeting input validation; implement enhanced audit logging on all payment module transactions; consider disabling the Elavon module entirely if alternative payment gateways are available; conduct enhanced PCI-DSS compliance verification of payment data handling workflows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB