Drupal Issues Urgent Patch for Critical Commerce Core Flaw Actively Exploited in Attacks

Critical Vulnerability Threatens E-Commerce Sites

Drupal has issued an urgent advisory warning administrators to immediately patch a critical access bypass vulnerability affecting the Commerce Core module. Tracked as CVE-2026-118539, the security flaw allows unauthenticated attackers to exploit a missing authorization weakness. The vulnerability leaves online stores exposed to potential financial disruption and unauthorized access.

According to the advisory, the flaw arises because the module fails to sufficiently protect certain routes and entity fields. Unauthenticated threat actors can abuse these unprotected pathways, posing a direct threat to vendors utilizing the platform for digital sales and shopping applications.

Affected Versions and Immediate Remediation

The vulnerability impacts multiple iterations of the popular e-commerce framework:

• Commerce Core versions 0.0.0 through 2.41
• Commerce Core versions 3.0.0 through 3.3.13

Drupal's security team has urged administrators running the 3.x branch to upgrade immediately to version 3.3.13. Sites operating on earlier iterations should update to Commerce Core 8.x-2.41. In addition to applying patches, administrators are strongly advised to audit existing orders for any unusual inconsistencies that may indicate prior compromise.

Commerce Core serves as a foundational framework for building e-commerce platforms and shopping apps on top of the Drupal Content Management System (CMS). The module is currently utilized by more than 42,000 websites, including high-profile organizations, research universities, and Fortune 500 companies.

Context and Broader Security Landscape

This advisory follows a series of recent security challenges for the platform. In May, Drupal warned of an SQL injection vulnerability in its database abstraction API that led to remote code execution and privilege escalation, prompting action from federal agencies. Additional remote code execution vulnerabilities were also patched earlier in the month.

Practical Implications and Verification

What is Confirmed

• A critical access bypass vulnerability (CVE-2026-118539) exists in Drupal Commerce Core.
• Unauthenticated attackers are actively exploiting the flaw in the wild.
• The vulnerability can cause financial impact to vendors by failing to protect specific routes and entity fields.
• Official patches are available in versions 3.3.13 and 8.x-2.41.

What Remains Unknown

• Specific details regarding the identity of threat actors or the precise scope of successful attacks against individual organizations have not been publicly disclosed.

How to Verify the Announcement

Administrators and interested readers can review the official advisory, check detailed version requirements, and obtain the necessary updates directly through the [Bleeping Computer Report](https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/).