Drupal Commerce Core Under Active Attack for Authorization Bypass Flaw

The Drupal project has alerted site administrators about a critical authorization bypass vulnerability affecting the Commerce Core module, which is currently being leveraged in active attacks. Designated as CVE-2026-118539, the vulnerability arises from insufficient authorization checks and can be exploited by unauthenticated threat actors. The flaw impacts Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.

The Drupal security team has instructed administrators running the 3.x branch to upgrade immediately to Commerce Core 3.3.13, while those on earlier versions should move to Commerce Core 8.x-2.41. Additionally, site operators are advised to review their order records for any suspicious activity, given that attackers are actively exploiting this flaw in the field.

According to Drupal's Wednesday advisory, which carries a highly critical designation, "This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs." The advisory further states: "The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild."

Commerce Core serves as a foundational framework for constructing e-commerce platforms and shopping applications built on the Drupal content management system. The module has achieved significant adoption, powering more than 42,000 websites globally, including installations at Fortune 500 enterprises and academic research institutions.

This disclosure follows a pattern of recent critical vulnerabilities affecting the Drupal ecosystem. In May, the project disclosed an SQL injection flaw (CVE-2026-9082) in the database abstraction API that could enable privilege escalation, data theft, and remote code execution. The US Cybersecurity and Infrastructure Security Agency subsequently added this vulnerability to its Known Exploited Vulnerabilities catalog and mandated that federal agencies remediate their systems within three days.

Two weeks prior to the Commerce Core warning, Drupal released patches for two additional remote code execution vulnerabilities (CVE-2026-108097 and CVE-2026-108099) that could permit attackers to execute arbitrary code. The project cautioned administrators that exploitation code could be developed "within hours or days" and urged rapid deployment of fixes.

Over the past several years, CISA has documented five Drupal vulnerabilities that have been exploited in active attacks, with two of these flaws also being weaponized by ransomware operations.