GoKawiilDrupal patches actively exploited Commerce Core access bypass flaw
Drupal issued a highly critical advisory for CVE-2026-118539, a missing-authorization bug in its Commerce Core module that lets unauthenticated attackers bypass access controls. The flaw affects Commerce Core versions 0.0.0-2.41 and 3.0.0-3.3.13, and Drupal says it is already being exploited. Admins are urged to update to 3.3.13 or 8.x-2.41 and review order records for signs of tampering.
GoKawiil's interpretation of the reporting above, not reported fact.
Commerce Core powers e-commerce on more than 42,000 sites, including Fortune 500 companies and universities, so active exploitation could let attackers manipulate transactions or orders at scale before patches are applied. This marks the third major Drupal vulnerability flagged as exploited in recent months, following a May SQL injection flaw added to CISA's Known Exploited Vulnerabilities list, suggesting attackers are increasingly targeting the platform's ecosystem of modules.
- CVE-2026-118539 is an unauthenticated access-bypass flaw in Drupal's Commerce Core module, rated highly critical.
- Affected versions span 0.0.0-2.41 and 3.0.0-3.3.13; fixes are available in 3.3.13 and 8.x-2.41.
- It's the latest in a string of actively exploited Drupal vulnerabilities disclosed since May, including one added to CISA's KEV catalog.
Source: bleepingcomputer.com, 2026-10-30
Published there as: “Drupal warns of critical Commerce Core flaw exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.