Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
Tracked as CVE-2026-118539, this flaw stems from a missing authorization weakness that can be abused by unauthenticated attackers and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
The Drupal security team asked admins on the 3.x branch to upgrade immediately to Commerce Core 3.3.13 (or Commerce Core 8.x-2.41 for earlier versions) and audit orders for inconsistencies, since threat actors are exploiting this vulnerability in attacks.
“This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs,” Drupal said in a Wednesday advisory tagged as highly critical.
“The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild.”
Commerce Core is a community-developed Drupal module used by more than 42,000 websites, including many high-profile organizations such as Fortune 500 companies and research universities.
The module provides a software framework for building and running e-commerce sites and shopping apps on top of the Drupal Content Management System (CMS).
In May, Drupal also warned that attackers were exploiting an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API that could lead to privilege escalation, information disclosure, and remote code execution.
Days later, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch their systems within three days.
Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon as possible because attackers could develop exploits “within hours or days.”
Over the last several years, CISA has flagged 5 Drupal vulnerabilities exploited in the wild, two of which have also been abused by ransomware gangs.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
