Drupal has warned that a critical access bypass vulnerability in its Commerce Core module is being actively exploited against live online stores, urging site owners to patch immediately and audit their order records for signs of tampering.

The flaw, tracked as CVE-2026-118539, stems from a missing authorization check and can be exploited by unauthenticated attackers. It affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.

According to Drupal’s advisory, the module fails to sufficiently protect certain routes and entity fields, creating an access bypass that can financially impact vendors. The Drupal security team tagged the issue as highly critical and confirmed it is being exploited in the wild.

Who is affected

Commerce Core is a community-developed module used to build e-commerce storefronts and shopping apps on top of the Drupal CMS, supporting both traditional shopping cart checkouts and decoupled applications via APIs. It is deployed on more than 42,000 websites, including Fortune 500 companies and research universities.

Remediation

  • Sites on the 3.x branch should upgrade immediately to Commerce Core 3.3.13.
  • Sites on earlier branches should upgrade to Commerce Core 8.x-2.41.
  • Admins should audit existing orders for inconsistencies that may indicate exploitation.

This is not Drupal’s first actively exploited flaw this year. In May, the project warned of an SQL injection vulnerability (CVE-2026-9082) in its database abstraction API that could enable privilege escalation, information disclosure, and remote code execution. CISA added that flaw to its Known Exploited Vulnerabilities catalog days later and gave federal agencies three days to patch. Two weeks ago, Drupal also patched two remote code execution issues (CVE-2026-108097 and CVE-2026-108099), warning that attackers could weaponize such flaws within hours or days of disclosure.

Over the past several years, CISA has flagged five Drupal vulnerabilities as actively exploited, two of which have also been abused by ransomware operators, underscoring the platform’s attractiveness as a target given its widespread use in e-commerce and enterprise web deployments.