Critical Drupal Commerce Core Flaw Actively Exploited, Urging Immediate Patching
Drupal has issued an urgent warning to administrators regarding a critical access bypass vulnerability in its **Commerce Core** module, which is actively being exploited in the wild. Tracked as **CVE-2026-118539**, this flaw allows unauthenticated attackers to bypass authorization, potentially leading to significant financial impact for affected vendors. All users of **Commerce Core** are advised to patch immediately and audit their systems for inconsistencies.
**Drupal** has alerted its community to an actively exploited critical access bypass vulnerability within its **Commerce Core** module. The flaw, identified as **CVE-2026-118539**, stems from insufficient authorization protection on specific routes and entity fields, enabling unauthenticated attackers to gain unauthorized access.
### Vulnerability Details and Impact
The **Commerce Core** module, a widely used framework for building e-commerce sites on the **Drupal Content Management System (CMS)**, is central to over 42,000 websites, including those of Fortune 500 companies and research universities. The vulnerability affects **Commerce Core** versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
According to the **Drupal** security advisory, the flaw's exploitation can lead to direct financial impact for vendors. Given the active exploitation, administrators are urged to not only update but also to conduct thorough audits of their orders for any anomalies.
### Urgent Patching Recommended
For those on the 3.x branch, the recommended update is to **Commerce Core 3.3.13**. Users of earlier versions should upgrade to **Commerce Core 8.x-2.41**. The **Drupal** security team has stressed the urgency of these updates, highlighting the real-world threats posed by this vulnerability.
### A Pattern of Exploited Drupal Vulnerabilities
This isn't the first time **Drupal** has faced critical, actively exploited vulnerabilities. In May, an **SQL injection** flaw (**CVE-2026-9082**) in the database abstraction API was targeted, leading to potential privilege escalation, information disclosure, and remote code execution. The **US Cybersecurity and Infrastructure Security Agency (CISA)** subsequently added this flaw to its **Known Exploited Vulnerabilities (KEV) Catalog**, mandating federal agencies to patch within three days.
Just two weeks prior, **Drupal** addressed two **remote code execution (RCE)** vulnerabilities (**CVE-2026-108097** and **CVE-2026-108099**), warning that exploits could emerge rapidly. Over the years, **CISA** has flagged five **Drupal** vulnerabilities as actively exploited, with some even leveraged by ransomware groups. This ongoing trend underscores the critical need for vigilant patching and robust security practices for all **Drupal** deployments.