Drupal is urging administrators to immediately patch a critical access-bypass vulnerability in its Commerce Core module after confirming that attackers are exploiting the flaw in the wild. The vulnerability, tracked as CVE-2026-118539, can be exploited without authentication and may have financial consequences for affected online stores.
The missing-authentication vulnerability affects Commerce Core versions 0.0.0 through 2.41 and versions 3.0.0 through 3.3.13. Drupal’s security team has advised administrators using the 3.x branch to upgrade immediately to Commerce Core 3.3.13. Administrators running earlier versions should upgrade to Commerce Core 8.x-2.41 and audit their orders for discrepancies.
Attackers are exploiting Commerce Core flaw
“This module allows you to sell goods and services to your customers through an attached shopping cart or checkout form, or a separate application via an API,” Drupal said in Wednesday’s advisory, which was tagged as very important.
“This module does not sufficiently protect certain route and entity fields, which could result in access bypass and have financial implications for the vendor. This vulnerability is being actively exploited in the wild.”
Commerce Core is a community-developed Drupal module used to build and operate e-commerce websites and shopping applications on the Drupal content management system. It is used by more than 42,000 websites, including sites operated by Fortune 500 companies and research universities.
Recent Drupal vulnerabilities
Drupal also warned in May that attackers were exploiting a SQL injection vulnerability, CVE-2026-9082, in its database abstraction API. The flaw could lead to privilege escalation, information disclosure and remote code execution.
A few days later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch their systems within three days.
Two weeks ago, Drupal patched two additional remote code execution vulnerabilities, CVE-2026-108097 and CVE-2026-108099. The issues could allow attackers to execute code remotely, and Drupal urged administrators to apply the updates as soon as possible because attackers could develop exploits “within hours or days.”
Over the past few years, CISA has listed five Drupal vulnerabilities in its catalog. Two of those vulnerabilities are being exploited by ransomware gangs.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com