Drupal urges immediate patches as hackers target an online store access flaw

Drupal has warned administrators to patch a highly critical access bypass vulnerability in its Commerce Core module that threat actors are actively exploiting in the wild. Tracked as CVE-2026-118539, the security flaw stems from a missing authorization weakness that unauthenticated attackers can abuse. The vulnerability affects Commerce Core versions 0.0.0 through 2.41 alongside versions 3.0.0 through 3.3.13. [1][2]

According to Drupal, the module fails to adequately protect specific routes and entity fields, allowing bypasses that could financially harm vendors. The Drupal security team has advised store operators running the 3.x release to upgrade to Commerce Core 3.3.13, while earlier installations should move to Commerce Core 8.x-2.41. In addition to updating, site administrators are urged to audit recent orders for potential inconsistencies. [1][2]

The Commerce Core framework powers shopping carts, checkout forms, and API integrations for more than 42,000 websites, including Fortune 500 businesses and research universities. [2]