CVE-2026-122071 Drupal CVE debrief

Who should care

Defenders responsible for maintaining and securing Drupal Commerce installations using the commerce_escrow module should assess their exposure and prioritize verification and updates.

Why it matters

The CVE-2026-122071 vulnerability in the Drupal Commerce Escrow module requires defenders to verify and update the module to prevent potential payment and order status manipulation.

• Defenders must verify and update the commerce_escrow module to prevent potential payment and order status manipulation.
• Drupal Commerce installations using the commerce_escrow module may be vulnerable to attack if not properly configured or updated.
• Defenders should monitor for suspicious payment and order status updates to detect potential exploitation.

Technical summary

The Drupal Commerce Escrow module enables payments through Escrow.com with Drupal Commerce. However, the module doesn't sufficiently verify incoming Escrow.com webhook notifications, allowing an attacker to forge payment and order status updates. This vulnerability affects Drupal Commerce installations using the commerce_escrow module, potentially allowing attackers to manipulate payment and order status. The module's lack of verification of incoming webhook notifications creates a risk of unauthorized payment and order status updates. Defenders should prioritize verifying and updating the commerce_escrow module to version 1.1.0 or later, and monitoring for suspicious payment and order status updates. The CVE-

Defensive priority

Defenders should prioritize verifying and updating the commerce_escrow module to version 1.1.0 or later, and monitoring for suspicious payment and order status updates.

Recommended defensive actions

• Verify and update the commerce_escrow module to version 1.1.0 or later
• Monitor for suspicious payment and order status updates
• Review and adjust the verification process for incoming Escrow.com webhook notifications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides limited information about the vulnerability, but it appears that the commerce_escrow module is affected by a lack of verification of incoming Escrow.com webhook notifications.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.