Drupal is urging online store owners to patch a highly critical access bypass vulnerability in the Commerce Core module, warning that it is being exploited in the wild.
Tracked as CVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process. Drupal’s statistics show the module is used on more than 42,000 sites.
“The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor,” Drupal explains in its advisory.
The Drupal security team gave the issue a risk score of 21 out of 25. According to the score, unauthenticated attackers can exploit the flaw no matter how the module is set up.
Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted. It has also not said whether the vulnerability was exploited as a zero-day, before patches became available.
The vulnerability affects 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. Administrators should update to one of the two fixed versions and review their store orders.
“Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the advisory reads.
The 38 other advisories Drupal published on October 28 address vulnerabilities in 21 contributed projects. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders via Stripe being marked as paid without payment.
The CAPTCHA module also received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge. Drupal’s rating indicates that exploit code for this bug exists in the wild, although the advisory doesn’t mention active exploitation.
Drupal’s ratings also indicate that proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.
On October 14, Drupal announced fixes for two critical remote code execution bugs: CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaws on its own, but certain other contributed modules or custom code make exploitation possible, in some cases without authentication.
Ahead of its October 14 security releases, Drupal cautioned that exploits might appear within hours or days. So far, however, there have been no public reports of the flaws being exploited in the wild.
CVE-2026-9082, a highly critical SQL injection issue in Drupal core’s database abstraction API that affects PostgreSQL-backed sites, did attract exploitation attempts in May.
Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
