Attackers Exploit Drupal Commerce Core Authorization Bypass Against Online Stores

Drupal warned that attackers are actively exploiting CVE-2026-118539, a highly critical authorization bypass in the contributed Commerce Core module, used on more than 42,000 websites. Insufficient protection of certain routes and entity fields allows unauthenticated attackers to bypass access controls regardless of module configuration, potentially causing financial harm to merchants. Drupal assigned the vulnerability a risk score of 21 out of 25; attacker identities, exploitation techniques and the number of affected stores have not been disclosed.

Administrators should urgently upgrade to Commerce Core 3.3.13 or 8.x-2.41, depending on their release branch, and audit orders for inconsistencies. Reported vulnerable releases include 3.x versions before 3.3.13 and earlier releases before 8.x-2.41, although one report inconsistently includes the fixed versions in its affected ranges; administrators should verify applicability against Drupal’s advisory. It remains unclear whether exploitation began before patches became available.