Drupal says a highly critical access bypass flaw in Commerce Core is already being used against online stores, raising the stakes for administrators who have not yet installed the fixed release. The issue, tracked as CVE-2026-118539, affects a module that adds shopping cart and checkout features to Drupal websites.
The warning lands now because Drupal says the exploitation is happening in the wild, not just in theory. The module is used on more than 42,000 sites, and the security team rated the flaw 21 out of 25, a score that signals serious risk for stores that rely on it to manage orders and customer-facing routes.
Commerce Core sits inside Drupal’s e-commerce setup, and the flaw matters because it can let unauthenticated attackers get around access controls no matter how the module is configured. Drupal said the module does not sufficiently protect certain routes and entity fields, and that the bypass may financially affect the vendor if orders are altered or abused.
What Drupal has not said is just as important. It has confirmed the attacks are happening, but it has not disclosed how the bug is being exploited or who is behind it, leaving site owners with a warning but not a map of the threat. That gap makes the update urgent, because defenders cannot wait for a full explanation before they move.
Drupal urged administrators to update to one of the two fixed versions, 3.x versions before 3.3.13 and earlier releases before 8.x-2.41. It also told sites to audit their orders for inconsistencies, a sign that the risk is not limited to access alone but may extend into the transaction flow that stores depend on.
The advisory also arrives in a busy stretch for Drupal security. On October 28, it published 38 other advisories covering vulnerabilities in 21 contributed projects, nearly a dozen of them critical. But CVE-2026-118539 stands apart because Drupal says it is already under active exploitation, which turns a software warning into a live operational problem for site owners.
That is the immediate task now: patch the fixed version, check orders, and assume the flaw has already been tried against the store until the logs prove otherwise.
