Attackers Exploit Critical Drupal Commerce Core Authorization Flaw

Summary

Drupal has warned that threat actors are actively exploiting a "highly critical" missing-authorization flaw in Commerce Core, the Drupal module that lets sites sell goods and services to customers through a shopping cart. The flaw is tracked as CVE-2026-118539, has no CVSS score listed, and affects Commerce Core versions from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. BleepingComputer reports that Drupal urged administrators to patch the critical access bypass flaw, which attackers are exploiting in the wild.

Timeline

1. The Hacker News

   30 Oct 2026, 07:45 UTCSource ↗

   Reports that Drupal has warned threat actors are exploiting a "highly critical" missing-authorization flaw in Commerce Core, tracked as CVE-2026-118539 (no CVSS score listed), affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13.

2. BleepingComputer

   30 Oct 2026, 10:16 UTCSource ↗

   Reports that Drupal warned administrators to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.