Drupal warns of actively exploited critical Commerce Core flaw

Drupal has warned administrators to patch a critical access bypass vulnerability in its Commerce Core module, saying attackers are exploiting it in the wild.

Tracked as CVE-2026-118539, the flaw stems from missing authorization protections. Unauthenticated attackers can exploit it through certain routes and entity fields, potentially causing financial harm to vendors, according to Drupal’s advisory.

The vulnerability affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal’s security team urged administrators on the 3.x branch to upgrade immediately to Commerce Core 3.3.13, or to Commerce Core 8.x-2.41 for earlier versions. It also advised auditing orders for inconsistencies.

Commerce Core is a community-developed module for building e-commerce sites and shopping apps on Drupal. It is used by more than 42,000 websites, including Fortune 500 companies and research universities.

Drupal said the module supports sales through an included shopping cart and checkout form or through decoupled applications using APIs. The advisory was tagged as highly critical.