Drupal on Oct. 28 warned security teams that attackers are exploiting a “highly critical” access bypass bug in its Commerce Core module that should be patched right away.
The flaw — CVE-2026-118539 — affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
Drupal said for teams using 3.x, upgrade to Commerce Core 3.3.13; teams using an earlier version should upgrade to Commerce Core 8.x-2.41.
John Watters, chief executive officer at iCounter, said this one's important because Drupal Commerce Core runs on more than 42,000 sites, including Fortune 500 companies and research universities. Watters said the flaw lets an attacker with little more than a shopping cart bypass access controls on parts of the store.
Drupal told customers to audit their orders, and the fix shows why: attackers can go after the transaction itself by changing order totals, pricing, or coupons in ways that cost the merchant money and may go unnoticed until reconciliation. Watters said Drupal has had a run of these, and threat actors target it and similar platforms specifically because of that history.
“CISA has flagged five Drupal vulnerabilities as exploited in the wild, and ransomware groups have used two of them, so organizations should assume any announced vulnerability will be targeted immediately and that criminal groups are already working through the list of exposed Commerce sites,” said Watters.
Carl Anthony, threat intelligence SkillBridge analyst at Blackpoint Cyber, added that his team highly advises organizations running Drupal Commerce for online sales to upgrade immediately. Anthony said certain routes and entity fields aren’t properly protected, allowing attackers to reach order and payment functionality without ever logging in.
“Drupal says the impact is financial to the [ecommerce] vendor, which points to order, pricing, or payment-state manipulation rather than code execution,” said Anthony. “The danger is that exploitation requires no credentials and involves no malware, and the resulting requests can look like ordinary storefront traffic. Two RCE flaws were patched two weeks ago, and an actively exploited SQL injection flaw — CVE-2026-9082 — was added to CISA’s KEV catalog in May, highlighting how attractive this application is to threat actors.”
Robert Coles, senior manager of threat intelligence security at Black Duck, said this Drupal case has moved beyond theoretical risk: we already know it’s being exploited.
“If you’re running an affected version of Drupal Commerce, I wouldn’t treat this as just a patching exercise,” said Coles. “Patch it now, then go back and validate what happened before the fix was applied. Drupal is specifically telling organizations to review orders for inconsistencies, and that’s exactly the right mindset. Fix the vulnerability but also assume the team may need to investigate what happened while the organization was exposed.”
