Drupal Warns of Actively Exploited Commerce Core Access Bypass
Summary
Drupal says attackers are actively exploiting CVE-2026-118539, an unauthenticated access-bypass flaw in Commerce Core. It urges administrators to update and audit orders for inconsistencies.
Key points
- CVE-2026-118539 is a missing-authorization flaw that can let unauthenticated attackers bypass access controls on certain routes and entity fields.
- Drupal says the vulnerability is being actively exploited in the wild; the article provides no independent confirmation or victim-specific incident details.
- The article lists affected Commerce Core versions as 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
- Drupal recommends upgrading to Commerce Core 3.3.13 for the 3.x branch or 8.x-2.41 for earlier versions, and auditing orders for inconsistencies.
- Commerce Core is used by more than 42,000 websites, according to the article.
Article Details
- Vulnerability Types
- Missing authorization resulting in an access bypass
- Severity
- Critical; Drupal classified it as highly critical.
- Affected Versions
- Commerce Core 0.0.0 through 2.41
- Commerce Core 3.0.0 through 3.3.13
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-108097Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon asCVE-2026-108099Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon asCVE-2026-118539Tracked as CVE-2026-118539, this flaw stems from a missing authorization weakness that can be abused by unauthenticated attackers and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.CVE-2026-9082In May, Drupal also warned that attackers were exploiting an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API that could lead to privilege escalation, information disclosure, and remote code