Drupal has warned administrators about a critical access bypass vulnerability in the Commerce Core module, tracked as CVE-2026-118539, which is currently being exploited by threat actors in the wild. Affected users are urged to apply immediate security patches and audit their systems.
BleepingComputer
The Drupal security team has issued a highly critical advisory concerning a vulnerability within the Commerce Core module. The flaw, identified as CVE-2026-118539, involves a missing authorization weakness that allows unauthenticated attackers to bypass security measures.
This vulnerability affects specific versions of the Commerce Core module, including versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal stated that the module does not sufficiently protect certain routes and entity fields, which can lead to potential financial impact on the vendor.
Because threat actors are actively exploiting this flaw, the Drupal security team has instructed administrators to upgrade immediately. Users on the 3.x branch should update to Commerce Core 3.3.13, while those on earlier versions should upgrade to Commerce Core 8.x-2.41. Furthermore, administrators are advised to audit their orders for any inconsistencies.
Commerce Core is a community-developed framework used to build and run e-commerce sites and shopping applications on the Drupal Content Management System. It is utilized by over 42,000 websites, including numerous Fortune 500 companies and research universities.
This warning follows other recent security concerns raised by Drupal. In May, the platform also cautioned about an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API, which could enable privilege escalation and remote code execution. Days later, the US Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities Catalog.
In recent weeks, Drupal has also patched two remote code execution security issues (CVE-2026-108097 and CVE-2026-108099), urging users to apply updates rapidly as attackers could develop exploits within hours or days.
CISA has previously flagged five Drupal vulnerabilities that have been exploited in the wild, two of which have been leveraged by ransomware gangs. The security community notes that overall prevention scores can be misleading, as defenses often drop sharply once attackers gain initial access using valid credentials.