Drupal warns of critical Commerce Core flaw exploited in attacks

What it is

Drupal's security team published a "highly critical" advisory for CVE-2026-118539, a missing-authorization flaw in the Commerce Core module. Unauthenticated attackers can exploit it, and Drupal states it is being exploited in the wild. Commerce Core provides the shopping cart, checkout form and API-based commerce on Drupal, and the page says more than 42,000 sites use it.

How it works

Per the advisory, the module "doesn't sufficiently protect certain routes and entity fields," which gives an access bypass that "may financially impact the vendor." The page gives no exploit details, request patterns or indicators beyond this.

Preconditions / Affected

• Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
• No authentication is needed.
• Any site running the module with those routes and fields exposed is in scope. The page names no configuration that avoids the flaw.

What to do

• Upgrade 3.x sites to Commerce Core 3.3.13. Sites on the older branch should use Commerce Core 8.x-2.41.
• Audit orders for inconsistencies, since the abuse is aimed at the vendor's finances. The page does not say what an inconsistency looks like.

Caveats

• The affected range includes 3.3.13, yet the same version is named as the upgrade target. The page does not explain this. Check the Drupal advisory for the exact fixed release before relying on 3.3.13.
• The page names no workaround, detection query or indicator of compromise.
• The article also lists other recent Drupal problems. CVE-2026-9082 is an SQL injection in the database abstraction API, exploited in May 2026. CISA added it to the KEV catalog and gave federal agencies three days to patch. Two weeks before the article, Drupal patched two remote code execution flaws, CVE-2026-108097 and CVE-2026-108099, warning that attackers could build exploits "within hours or days."
• CISA has flagged 5 Drupal vulnerabilities as exploited in the wild over the last several years, and two were used by ransomware gangs. The page does not say whether CVE-2026-118539 is in KEV.