Drupal warns Commerce Core access bypass is actively exploited

Drupal's security team warned on Wednesday that attackers are exploiting a flaw in the Commerce Core module that lets them bypass access controls. The flaw, CVE-2026-118539, stems from missing authorization and can be abused by unauthenticated attackers, according to Drupal's advisory, which the project tagged as highly critical.

The flaw affects Commerce Core releases from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Drupal said the module, which "enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," does not sufficiently protect certain routes and entity fields. That leads to an access bypass that "may financially impact the vendor," the advisory says.

Drupal recommends that sites running the 3.x branch upgrade immediately to Commerce Core 3.3.13. Earlier installations should move to Commerce Core 8.x-2.41. The security team also asked administrators to audit orders for inconsistencies, because threat actors are exploiting the vulnerability in attacks.

The advisory does not provide details about the exploitation activity, such as the number of targeted sites or the tactics used. The Hacker News reported that Drupal acknowledged the flaw is "actively exploited in the wild" but gave no specifics about the nature or extent of the campaign.

BleepingComputer reports that Commerce Core is a community-built Drupal module installed on over 42,000 sites, including Fortune 500 companies and research universities. The module gives developers a base for creating and operating online stores and shopping applications on the Drupal CMS.

Drupal credited researchers Dan Puccetti, Marcus Johansson, and Robert Snyder with reporting the flaw.

The warning follows other Drupal security issues this year. In May, Drupal reported active exploitation of CVE-2026-9082, an SQL injection issue in its database abstraction API that could enable privilege escalation, information disclosure, or remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency later added that flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch. Drupal also patched two remote code execution flaws, CVE-2026-108097 and CVE-2026-108099, two weeks ago and urged admins to apply updates quickly because attackers could develop exploits "within hours or days," BleepingComputer reported. In the past few years, CISA has listed five Drupal vulnerabilities in its catalog of known exploited flaws, and two of those have been used by ransomware groups, BleepingComputer says.

Defenders should verify their Commerce Core version, apply the appropriate update, and review orders for signs of unauthorized changes, Drupal said.