Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539

Drupal warns that attackers are exploiting a critical authorization flaw in its Commerce Core module, tracked as CVE-2026-118539. The vulnerability stems from missing authorization checks that allow forceful browsing and access bypass of certain routes and entity fields, potentially financially impacting vendors. It affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Researchers Dan Puccetti, Marcus Johansson and Robert Snyder reported the issue, and the open-source maintainers confirmed active exploitation in the wild. Drupal recommends updating installations: users on the 3.x branch should upgrade to version 3.3.13, while those on earlier releases should move to Commerce Core 8.x-2.41. The advisory notes that a similar SQL injection flaw, CVE-2026-9082, was previously exploited and added to the CISA KEV catalog. ¹