Drupal Commerce Core access bypass exploited against online stores
Original title: Drupal Commerce Core Vulnerability Exploited Against Online Stores
Unauthenticated attackers can hit the flaw on more than 42,000 sites; fixed releases are 3.3.13 and 8.x-2.41.
Drupal is urging store owners to patch CVE-2026-118539, a highly critical access bypass in the Commerce Core module that it says is being exploited. The module, used on more than 42,000 sites, does not sufficiently protect certain routes and entity fields, and Drupal scored the issue 21 out of 25. Affected releases are 3.x before 3.3.13 and earlier lines before 8.x-2.41. Drupal confirmed attacks but has not described the method, the actors, the number of sites hit, or whether exploitation began before patches.
Unconfirmed: Drupal confirmed exploitation but not the method, actors, target count, or whether it was a zero-day.
- Drupal says unauthenticated attackers can exploit the flaw regardless of module configuration.
- Administrators should update and audit store orders for inconsistencies.
- The same October 28 batch included 38 other advisories across 21 contributed projects.
- Drupal has not said whether CVE-2026-118539 was exploited as a zero-day.
Impact: Unauthenticated access bypass that may financially harm stores
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Commerce Core | 3.x before 3.3.13 and earlier releases before 8.x-2.41 | 3.3.13 and 8.x-2.41 |
- 1.Update Commerce Core to 3.3.13 or 8.x-2.41.
- 2.Audit store orders for inconsistencies.
- CVEs
- CVE-2026-118539
- Vendors
- Drupal
- Products
- Commerce Core
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118539 | Missing authorization in Drupal Commerce Core | 6.5 | — |
From the original article
2 min read at securityweek.com
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders. The post Drupal Commerce Core Vulnerability Exploited Against Online Stores appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.