Hackers Actively Exploit Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal warns of active exploitation of a critical authorization bypass vulnerability (CVE-2026-118539) in its Commerce Core component, affecting multiple versions and potentially leading to financial losses.
Drupal has issued a stern warning regarding the active exploitation of a critical security vulnerability within its Commerce Core component. The flaw, identified as CVE-2026-118539, is a severe authorization bypass that allows threat actors to circumvent access controls on Drupal websites utilizing the e-commerce module.
The vulnerability impacts Commerce Core versions ranging from 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal describes the module as essential for enabling e-commerce functionalities, including shopping cart and checkout forms, as well as API-driven decoupled applications. The core issue lies in the module's insufficient protection of certain routes and entity fields, which attackers can leverage to bypass authorization mechanisms.
Drupal has confirmed that this vulnerability is being "actively exploited in the wild." While specific details regarding the scale or nature of these attacks have not been disclosed, the advisory emphasizes the potential for significant financial damage to vendors relying on the affected e-commerce platforms. The urgency of the situation is underscored by the "highly critical" classification of the flaw.
To mitigate the risk, users are strongly advised to update their Drupal Commerce Core installations immediately. For version 3.x, the recommended upgrade is to Commerce Core 3.3.13. For earlier versions, users should upgrade to Commerce Core 8.x-2.41. These updates are expected to address the authorization bypass and prevent further exploitation.
The discovery and reporting of this vulnerability are credited to researchers Dan Puccetti, Marcus Johansson, and Robert Snyder. Their efforts have helped Drupal to quickly address and warn its user base about the critical security gap.
This incident occurs amidst a broader landscape of actively exploited vulnerabilities. Notably, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have also seen widespread exploitation attempts. Cloud security firm Wiz reported that as of October 25th, over 52% of organizations were significantly affected by PHP2Shell, with attackers employing both public proof-of-concept exploits and custom tooling.
The ongoing exploitation of the Drupal Commerce Core flaw highlights the persistent threat posed by authorization bypass vulnerabilities in widely used e-commerce platforms. Organizations relying on Drupal for their online sales operations must prioritize patching to protect sensitive financial data and prevent potential business disruption. The active exploitation in the wild serves as a stark reminder of the need for continuous security vigilance and prompt remediation of known vulnerabilities.