Overview
- Drupal has confirmed active exploitation of a missing-authorization flaw tracked as CVE-2026-118539 that lets attackers access protected routes and entity fields in the Commerce Core module.
- The bug affects Commerce Core releases from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13 and can be abused without valid user credentials to manipulate orders or checkout processes.
- Drupal published emergency fixes and told administrators to upgrade immediately to Commerce Core 3.3.13 for the 3.x branch or 8.x-2.41 for earlier branches and to audit orders and logs for suspicious activity.
- Commerce Core is installed on more than 42,000 sites, including large organizations and universities, which raises the risk of financial loss and operational disruption for affected online stores.
- Security firms note this incident fits a broader pattern of active web-platform attacks, with related exploit activity such as PHP2Shell and prior Drupal flaws prompting rapid emergency patching and CISA attention.