What is the CVSS score of CVE-2026-9726?

CVE-2026-9726 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Drupal AlternativeCommerce are affected by CVE-2026-9726?

The Drupal AlternativeCommerce module (versions ≤2.1.17) contains a critical unauthenticated remote code execution vulnerability with no public exploit currently identified.. A patch is available.

How to fix or mitigate CVE-2026-9726?

Within 24 hours, audit all Drupal installations to identify systems running AlternativeCommerce module versions up to 2.1.17. Within 7 days, deploy the patched version released by the Drupal Security team to all affected instances per vendor advisory. Within 30 days, conduct security testing on patched systems and review access logs from the vulnerability window for indicators of attempted exploitation.

Drupal AlternativeCommerce CVE-2026-9726

EUVD-2026-43042 CRITICAL

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-10 drupal

GHSA-ggc6-38jq-q957

Code Injection Drupal Drupal Alternativecommerce Basket

9.8

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated request reaches the injection sink (AV:N/PR:N/UI:N); PHP object injection typically yields code execution, so full C/I/A impact with AC:L absent evidence of a gating gadget requirement.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:30 vuln.today

CVSS changed

Jul 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 22:02 EUVD

CVE Published

Jul 10, 2026 - 20:56 cve.org

CRITICAL 9.8

CVE Published

Jul 10, 2026 - 20:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

AnalysisAI

PHP object injection in the Drupal AlternativeCommerce (Basket) contributed module (all versions up to and including 2.1.17) allows remote unauthenticated attackers to modify dynamically-determined object attributes and inject crafted objects into the application. Successful exploitation can lead to code execution or full compromise of the Drupal site, with CVSS 3.1 scoring it 9.8 (Critical). No public exploit identified at time of analysis, and EPSS is low at 0.16% (6th percentile), indicating no observed exploitation activity yet despite the high severity rating.

Technical ContextAI

AlternativeCommerce (Basket) is a community-contributed e-commerce/shopping-basket module for the Drupal CMS, written in PHP. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), which in PHP typically manifests as unsafe deserialization or 'object injection' where attacker-controlled input is passed into a routine that instantiates or mutates object properties (e.g., unserialize() on untrusted data or mass-assignment into object attributes). Because Drupal contrib modules run in the same PHP process as the CMS core, an injected object can trigger 'POP gadget' chains present in Drupal core or other loaded libraries, converting attribute manipulation into arbitrary code or data-tampering. The affected component is identified by CPE cpe:2.3:a:drupal:drupal_alternativecommerce_(basket):*:*:*:*:*:*:*:*.

RemediationAI

Upgrade the AlternativeCommerce (Basket) module to version 2.1.17 or later, which is the vendor-released fixed version per Drupal security advisory SA-CONTRIB-2026-038 (https://www.drupal.org/sa-contrib-2026-038); the input confirms a patch is available from the vendor. Apply the update through the standard Drupal module update process (composer update of the contrib package followed by database update via update.php or drush updatedb). If immediate patching is not possible, compensating controls include disabling and uninstalling the AlternativeCommerce (Basket) module entirely (trade-off: shopping-basket/commerce functionality provided by the module will be unavailable), and placing a WAF or reverse-proxy rule in front of the site to block or restrict access to the module's request endpoints and inspect for serialized-object payloads (trade-off: risk of false positives and incomplete coverage since object-injection payloads are highly variable). Restricting the affected pages to authenticated/trusted users where feasible reduces the unauthenticated attack surface.