Commerce CyberSource CVE-2026-81159

The attacker must have unauthenticated network access to the Commerce CyberSource endpoint on the target Drupal site. High attack complexity (AC:H) means reliable exploitation requires a low-latency network path to minimise timing noise - exploitation over high-jitter public internet paths is significantly harder. No authentication, special configuration, or user interaction is required beyond network reachability. The limiting factors are: network jitter reducing timing signal quality, and the requirement to issue a large number of repeated requests (detectable by rate-limiting or anomaly detection). Exploitation is not limited to a specific platform or OS but requires the affected module to be installed and active on a Drupal Commerce site.

The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a low-severity issue. Attack complexity is rated High (AC:H) because reliable timing attacks require controlled network conditions, sufficient statistical samples, and low jitter - difficult over public internet but feasible on low-latency paths. No privileges are required (PR:N) and there is no confidentiality impact (C:N), with only limited integrity impact (I:L) representing brute-force-enabled credential or token guessing. No EPSS score, CISA KEV listing, or public exploit code is provided in the input, and none is known at time of analysis. The practical risk to most Drupal Commerce sites is low: the high attack complexity limits opportunistic exploitation, and the absence of confidentiality impact means no direct data exfiltration. Prioritisation should focus on sites with externally reachable CyberSource payment endpoints on low-latency hosting environments.

An attacker with a low-latency network path to the Drupal Commerce CyberSource endpoint submits a large number of requests with varying candidate credentials or token values and measures server response times for each. By aggregating timing samples statistically, the attacker distinguishes valid from invalid inputs and progressively narrows the candidate space, ultimately brute-forcing a valid credential or token. No public proof-of-concept code has been identified, but the technique is standard and well-documented for CWE-208 vulnerabilities.