Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
InfraTrust report warns of exploited flaws in critical network infrastructure Arista patches new VeloCloud Orchestrator zero-day exploited in attacks CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Days later, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch their systems within three days.
Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon as possible because attackers could develop exploits "within hours or days." Over the last several years, CISA has flagged 5 Drupal vulnerabilities exploited in the wild, two of which have also been abused by ransomware gangs.
Tracked as CVE-2026-118539 , this flaw stems from a missing authorization weakness that can be abused by unauthenticated attackers and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
This vulnerability is being actively exploited in the wild." Commerce Core is a community-developed Drupal module used by more than 42,000 websites , including many high-profile organizations such as Fortune 500 companies and research universities.
In May, Drupal also warned that attackers were exploiting an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API that could lead to privilege escalation, information disclosure, and remote code execution.
As of October 25, the percentage of organizations significantly affected by PHP2Shell has declined to 52.1%, according to data from Google-owned Wiz.
Drupal warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.
The Drupal security team asked admins on the 3.x branch to upgrade immediately to Commerce Core 3.3.13 (or Commerce Core 8.x-2.41 for earlier versions) and audit orders for inconsistencies, since threat actors are exploiting this vulnerability in attacks.
What happened
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
InfraTrust report warns of exploited flaws in critical network infrastructure Arista patches new VeloCloud Orchestrator zero-day exploited in attacks CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
What changed
Days later, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch their systems within three days.
Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon as possible because attackers could develop exploits "within hours or days." Over the last several years, CISA has flagged 5 Drupal vulnerabilities exploited in the wild, two of which have also been abused by ransomware gangs.
Who is affected
Tracked as CVE-2026-118539 , this flaw stems from a missing authorization weakness that can be abused by unauthenticated attackers and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
This vulnerability is being actively exploited in the wild." Commerce Core is a community-developed Drupal module used by more than 42,000 websites , including many high-profile organizations such as Fortune 500 companies and research universities.
Why it matters
In May, Drupal also warned that attackers were exploiting an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API that could lead to privilege escalation, information disclosure, and remote code execution.
As of October 25, the percentage of organizations significantly affected by PHP2Shell has declined to 52.1%, according to data from Google-owned Wiz.
Technical details
Drupal warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.
The Drupal security team asked admins on the 3.x branch to upgrade immediately to Commerce Core 3.3.13 (or Commerce Core 8.x-2.41 for earlier versions) and audit orders for inconsistencies, since threat actors are exploiting this vulnerability in attacks.
The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
Attribution
BleepingComputer: Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
The Hacker News: Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.