Drupal warns admins to patch critical Commerce Core access bypass flaw

The Drupal security team has issued an urgent warning for administrators to patch a critical access bypass vulnerability affecting the Commerce Core module. Threat actors are already actively exploiting this security flaw in real-world attacks. Tracked as CVE-2026-118539, the issue stems from a missing authorization weakness.

• The vulnerability affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
• Unauthenticated attackers can abuse the missing authorization flaw to bypass access controls.
• Commerce Core is utilized by over 42,000 websites, including major enterprises and research institutions.

Vulnerability Details and Active Exploitation

The security flaw arises because the module fails to sufficiently protect certain routes and entity fields, enabling an access bypass that can financially impact online merchants. The Commerce Core module provides frameworks for selling goods and services through shopping carts, checkout forms, and decoupled API applications. Because threat actors are actively exploiting this in the wild, Drupal has requested immediate action.

Administrators running the 3.x branch are urged to upgrade immediately to Commerce Core 3.3.13, while those on earlier versions should upgrade to Commerce Core 8.x-2.41. Furthermore, site maintainers must audit existing orders for any inconsistencies or suspicious modifications resulting from unauthorized access attempts.

Broader Context of Recent Drupal Vulnerabilities

This disclosure follows a series of high-severity security advisories issued for the Drupal ecosystem in recent months. In May, Drupal warned about an SQL injection vulnerability (CVE-2026-9082) in its database abstraction API that could lead to privilege escalation and remote code execution, which was subsequently added to CISA's Known Exploited Vulnerabilities catalog.

Additionally, just two weeks ago, Drupal patched two separate remote code execution issues, urging rapid patching before automated exploits could be developed by threat actors. Over recent years, CISA has flagged multiple Drupal vulnerabilities that were actively leveraged in attacks, highlighting the persistent targets that content management systems represent.

What This Means for Web Administrators

For organizations and developers managing e-commerce platforms built on Drupal, this critical advisory demands immediate operational response. Failing to apply the Commerce Core updates leaves online stores exposed to financial manipulation and unauthorized transaction processing. Routine security audits and prompt patch management remain vital defenses against active exploitation campaigns.