Drupal Commerce Core authorization bypass actively exploited
Original title: Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
Drupal says attackers are exploiting a highly critical missing-authorization flaw in Commerce Core, tracked as CVE-2026-118539. The module fails to protect certain routes and entity fields, allowing an access bypass that may financially affect the vendor. Drupal gave no details on the activity. Separately, Wiz reports ongoing exploitation attempts against two critical PHP flaws collectively called PHP2Shell.
Unconfirmed: Drupal did not describe the exploit activity or campaign scope; the Wiz PHP2Shell figures are the company's observations.
- Affected ranges stated are 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
- Drupal recommends Commerce Core 3.3.13 or 8.x-2.41.
- Drupal credited Dan Puccetti, Marcus Johansson, and Robert Snyder.
- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, both scored 9.2.
- Wiz said 52.1% of organizations were significantly affected as of October 25.
Impact: Access bypass that may financially impact the vendor
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Commerce Core | 0.0.0 to 2.41 and 3.0.0 to 3.3.13 | 3.3.13 and 8.x-2.41 |
| PHP | — | — |
- 1.Upgrade Commerce Core 3.x to 3.3.13.
- 2.Upgrade earlier Commerce Core versions to 8.x-2.41.
- Vendors
- Drupal
- Products
- Commerce CorePHP
- Organizations
- Wiz
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-118539 | Missing authorization in Drupal Commerce Core | 6.5 | — |
From the original article
2 min read at thehackernews.com
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0. 0.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.