Drupal Commerce Core Authorization Bypass Flaw Actively Exploited
Summary
Drupal says attackers are actively exploiting an authorization-bypass flaw in Commerce Core versions through 2.41 and 3.3.13. It recommends updating but gave no details on the activity. The article also reports ongoing PHP2Shell exploitation attempts.
Key points
- Drupal identifies CVE-2026-118539 as a missing-authorization flaw in Commerce Core, with no CVSS score provided.
- Affected versions are 0.0.0 through 2.41 and 3.0.0 through 3.3.13; Drupal recommends updating to the latest version.
- Drupal says the flaw is actively exploited in the wild, but provided no details about the activity or its extent.
- Wiz reported that organizations significantly affected by PHP2Shell declined to 52.1% as of October 25.
- Wiz observed PHP2Shell activity using public PoC-matching exploit attempts, as well as separately branded tools relying on session poisoning and another LFI vulnerability.
Article Details
- Vulnerability Types
- Missing authorization (access bypass)
- Severity
- Highly critical; CVSS score not available
- Affected Versions
- Commerce Core 0.0.0 to 2.41
- Commerce Core 3.0.0 to 3.3.13
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
CVE
CVE-2026-109618The development comes as two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), and collectively referred to as PHP2Shell, are witnessing active exploitation attempts inCVE-2026-109619The development comes as two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), and collectively referred to as PHP2Shell, are witnessing active exploitation attempts inCVE-2026-118539The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
People
Alma BlachsanNamed as a Wiz researcher reporting observations of PHP2Shell-related activity.Dan PuccettiCredited by Drupal with reporting the Commerce Core authorization bypass vulnerability.Marcus JohanssonCredited by Drupal with reporting the Commerce Core authorization bypass vulnerability.Robert SnyderCredited by Drupal with reporting the Commerce Core authorization bypass vulnerability.Shahar DorfmanNamed as a Wiz researcher reporting observations of PHP2Shell-related activity.Yaara ShrikiNamed as a Wiz researcher reporting observations of PHP2Shell-related activity.Yaron SamuelNamed as a Wiz researcher reporting observations of PHP2Shell-related activity.
Products
Commerce CoreDrupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.PHPThe development comes as two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), and collectively referred to as PHP2Shell, are witnessing active exploitation attempts in