Drupal Commerce Core Critical Flaw Actively Exploited

Threat actors are actively exploiting a highly critical security flaw in Drupal's Commerce Core component. The vulnerability, tracked as CVE-2026-118539, involves a missing authorization issue that allows an access bypass. This flaw affects Commerce Core versions ranging from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. The insufficient protection of certain routes and entity fields may financially impact the vendor. Drupal acknowledged that the vulnerability is being actively exploited in the wild but provided no specific details regarding the nature of the exploitation activity or the extent of the campaign.

Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder reported the flaw. The Drupal Commerce Core module enables selling goods and services via shopping cart, checkout form, or decoupled applications via APIs. Users are recommended to upgrade to Commerce Core version 3.3.13 for the 3.x series. Users of earlier versions are recommended to upgrade to Commerce Core version 8.x-2.41. Drupal warned administrators to patch this critical access bypass vulnerability to mitigate ongoing attacks.