Drupal Commerce Core access bypass reported exploited in the wild
Releases before 2.41 and 3.0.0 before 3.3.13 are affected; Drupal rates the issue highly critical.
74
Product
Commerce Core
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenOct 30, 2026
- Last mentioned7h ago
Timeline
5 articles · newest firstDrupal Commerce access bypass exploited in the wild (CVE-2026-118539)
Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.
76
Drupal Commerce Core access bypass exploited against online stores
Unauthenticated attackers can hit the flaw on more than 42,000 sites; fixed releases are 3.3.13 and 8.x-2.41.
76
Drupal Commerce Core access bypass exploited in attacks
Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.
78
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
74
Related CVEs
by mentions- Missing authorization in Drupal Commerce Core
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Drupalvendor · 5
- Wizorganization · 1
- PHPproduct · 1
- Canadian Centre for Cyber Securityorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.