Executive Summary
Drupal has warned administrators to patch CVE-2026-118539 (advisory SA-CONTRIB-2026-254), a missing-authorization flaw in the Commerce Core module that attackers are actively exploiting in the wild. Drupal rates it "highly critical." The module says it "doesn't sufficiently protect certain routes and entity fields," allowing unauthenticated attackers to bypass access controls.
Commerce Core is used by more than 42,000 Drupal sites. Drupal notes the potential impact includes financial impact on the vendor.
Affected Versions
| Branch | Affected | Fixed |
|---|---|---|
| 2.x / earlier | 0.0.0 through 2.41 | 8.x-2.41 |
| 3.x | 3.0.0 through 3.3.13 | 3.3.13 |
Vulnerability Details
- Type: Missing authorization (access bypass)
- Authentication required: None
- Exploitation: Actively exploited per Drupal; attacker identity and scale not disclosed
Recommended Actions
- Upgrade Commerce Core immediately to the fixed release for your branch.
- Audit recent orders for inconsistencies, such as altered totals, statuses, or payment states, since exploitation is ongoing.
- Review web server logs for unusual requests to Commerce routes from unauthenticated clients.
- Consider temporary WAF rules or restricting commerce routes if you cannot patch right away.
Context
This is one of several recent Drupal issues. In May, Drupal warned of an actively exploited SQL injection (CVE-2026-9082) that CISA added to its KEV catalog. About two weeks before this advisory, Drupal patched two remote code execution flaws, CVE-2026-108097 and CVE-2026-108099. CISA has flagged five Drupal vulnerabilities as exploited over the years, two of them abused by ransomware groups.
References
- Drupal advisory SA-CONTRIB-2026-254
- BleepingComputer — Drupal warns of critical Commerce Core flaw exploited in attacks