Drupal Confirms Active Exploitation of Critical Commerce Core Flaw
Drupal has confirmed that CVE-2026-118539, a missing authorization flaw in the Commerce Core module, is being actively exploited. The module runs on more than 42,000 sites per Drupal's statistics, and two fixed versions exist: 8.x-2.41 and 3.3.13. Update immediately and audit store orders for inconsistencies, as Drupal itself advises.
What happened
Drupal has confirmed that attackers are actively exploiting a critical authorization flaw in the Commerce Core module, used on more than 42,000 sites according to Drupal's own statistics. The flaw lets unauthenticated attackers bypass access controls regardless of how the module is configured. Drupal has not said how the attacks work, who is behind them, or how many sites were hit.
Why it matters
Commerce Core adds shopping cart and checkout features to Drupal sites. Drupal's advisory states the access bypass may financially impact the vendor, and its call to audit orders signals a risk of compromised transactions. Stores that do not update remain exposed to ongoing attacks.
What to do
Update Commerce Core now to 8.x-2.41 or 3.3.13, the two fixed versions, and audit all store orders for inconsistencies. Also review the 38 other advisories Drupal published on October 28, nearly a dozen of them critical.
For the technical team
- CVE
- CVE-2026-118539
- Affected
- Drupal Commerce Core (falha de bypass de controle de acesso) · Commerce Core 3.x versions before 3.3.13 and earlier releases before 8.x-2.41 (SecurityWeek). The Hacker News lists 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
- Exploitation
- Active exploitation confirmed by Drupal. Drupal has not detailed the method, actors, number of targeted sites, or whether it was exploited as a zero-day before patches (SecurityWeek).
- Fix
- Update to 8.x-2.41 or 3.3.13, the two fixed versions (SecurityWeek). Audit store orders as a post-update check.
- Vector
- Drupal contributed module Commerce Core (e-commerce with cart and checkout). Missing authorization flaw: insufficiently protected routes and entity fields allow an access bypass. Per Drupal's risk score (21/25), unauthenticated attackers can exploit it no matter how the module is configured. CVSS: N/A (The Hacker News).
- More details
- Drupal published 38 advisories on October 28 covering 21 contributed projects; nearly a dozen critical, including remote code execution, account takeover, and Stripe Commerce orders marked as paid without payment. Proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display. The CAPTCHA module was fixed for a moderately critical bug allowing a protected form to be resubmitted without a new challenge; Drupal's rating indicates exploit code exists in the wild, though the advisory does not mention active exploitation. On October 14, Drupal fixed CVE-2026-108097 (Field UI) and CVE-2026-108099 (Entity List), both critical RCE flaws dependent on other modules or custom code, with no public reports of exploitation. CVE-2026-9082, a SQL injection in core's database abstraction API affecting PostgreSQL-backed sites, drew exploitation attempts in May.
Timeline
Drupal describes the flaw as an access bypass and urges store owners to audit their orders.
BleepingComputer covers Drupal's warning about the critical Commerce Core flaw already exploited in attacks.
Drupal's advisory details affected versions: Commerce Core 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
Want the next updates in your inbox? Get the daily edition →
See all 4 updates
Incident opened.
Sources 4 sources
- @TheHackersNews @TheHackersNews
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw The Hacker News
- @BleepinComputer @BleepinComputer
- Drupal Commerce Core Vulnerability Exploited Against Online Stores SecurityWeek
