CVE-2026-81159: Centarro Commerce Cybersource

Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

Affected products

• Centarro Commerce Cybersource: from 8.x-1.0, before 8.x-1.10 (fixed in 8.x-1.10)

Published 2026-09-02. Last modified 2026-09-16.