cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Drupal Commerce Core Access Bypass Exploited in the Wild

· Original article ↗

Summary

Drupal confirms active exploitation of CVE-2026-118539, an unauthenticated access-bypass flaw in Commerce Core. Affected releases are fixed in 3.3.13 and 8.x-2.41; store owners should update and audit orders.

Key points

  • Drupal confirms CVE-2026-118539 is being exploited in the wild.
  • The flaw affects Drupal Commerce Core and can allow unauthenticated access bypass, regardless of module configuration.
  • Affected releases are 3.x versions before 3.3.13 and earlier releases before 8.x-2.41; administrators should update to a fixed version.
  • Drupal advises store owners to review orders for inconsistencies.
  • Drupal has not disclosed the exploitation method, the actor, or how many sites were targeted.

Article Details

Vulnerability Types
  • Access bypass
Severity
Highly critical; risk score 21 out of 25
Affected Versions
  • Drupal Commerce Core 3.x versions before 3.3.13
  • Drupal Commerce Core releases before 8.x-2.41
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationUnauthenticated attackers are actively exploiting the access-bypass vulnerability in the Commerce Core module on online stores.

CVE

CVE-2026-118539Tracked as CVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process.

Vendors

DrupalDrupal is urging online store owners to patch a highly critical access bypass vulnerability in the Commerce Core module, warning that it is being exploited in the wild.

Products

Commerce CoreDrupal is urging online store owners to patch a highly critical access bypass vulnerability in the Commerce Core module, warning that it is being exploited in the wild.

Industries

E-commerceTracked as CVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process.

Related Articles