Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539
Drupal Commerce Core module has a critical authorization flaw, CVE-2026-118539, being exploited.
Drupal has issued a warning about a critical authorization vulnerability, CVE-2026-118539, in its Commerce Core module. Attackers are actively exploiting this flaw, which stems from missing authorization checks, to bypass access controls and potentially impact online stores financially. The vulnerability affects specific versions of Commerce Core, and users are urged to update to the latest releases.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Drupal?
Get an email when a new story names Drupal, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-118539 exposes a critical flaw in Drupal's Commerce Core module where missing authorization checks allow attackers to bypass access controls entirely. This means unauthenticated or low-privileged users can perform actions reserved for administrators, directly threatening the financial integrity of online stores. Active exploitation in the wild means that unpatched sites are already being targeted, not just theoretically at risk. The root failure is twofold: the module shipped without adequate authorization enforcement, and site operators failed to apply the patch before attackers weaponized the vulnerability.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-118539