Drupal has confirmed that attackers are exploiting a critical vulnerability in Commerce Core, the module that adds e-commerce features to sites built on its content management system. The flaw, identified as CVE-2026-118539, allows access controls to be bypassed and may affect stores without requiring the attacker to log in.
Drupal's security team urged administrators to install the patched versions and check their stores' orders for inconsistencies. The warning was published on October 28; BleepingComputer reported on it on October 30.
“The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild.”
— Drupal
Which Commerce Core versions are affected
The issue stems from a lack of authorization on certain routes and entity fields. Commerce Core is used to build stores and shopping applications on Drupal, with features such as a shopping cart and checkout. According to BleepingComputer, the module is present on more than 42,000 sites.
The vulnerability affects Commerce Core versions from 0.0.0 through 2.41, as well as versions in the 3.x branch earlier than 3.3.13. Drupal recommends updating the 3.x branch to version 3.3.13; for earlier installations, the indicated fix is Commerce Core 8.x-2.41.
The Canadian Centre for Cyber Security also recorded the alert on October 30. Its advisory identifies versions earlier than 2.41 and versions 3.0.0 earlier than 3.3.13 as vulnerable, and notes that there is public evidence of active exploitation.
Update and audit orders
Updating is not the only specific measure Drupal recommends: store operators should review orders for anomalies. The warning points to a potential financial impact on vendors, although Drupal has not publicly detailed the method used in the attacks or their scope.
SecurityWeek reports that Drupal assigned the flaw a risk score of 21 out of 25. According to the outlet, exploitation does not require authentication and is possible regardless of how the module is configured. Drupal, however, has not identified who is behind the activity or how many sites have been attacked.
The vulnerability adds to other recent security advisories for Drupal. BleepingComputer notes that an SQL injection identified as CVE-2026-9082 was exploited in May, and that in mid-October Drupal fixed two remote code execution flaws, CVE-2026-108097 and CVE-2026-108099. Those incidents provide no details about the current attacks against Commerce Core, but place the alert within a series of issues for which Drupal has urged users to apply patches quickly.
For now, Drupal has identified two tasks for administrators: install the patched version appropriate for their branch and audit Commerce Core orders.
Sources: BleepingComputer, Canadian Centre for Cyber Security, SecurityWeek
