Drupal reports active in-the-wild exploitation of Commerce Core flaw

Drupal reported active exploitation in the wild of a highly critical authorization bypass flaw, CVE-2026-118539, in its Commerce Core module on Oct. 30, 2026. The advisory warns of financial impact risks to vendors using the module. Unauthorized access to Commerce Core routes and entity fields may financially impact vendors, according to Drupal. The vulnerability is described as a missing authorization weakness.

Drupal labeled the flaw highly critical.

Unauthenticated attackers can exploit the flaw regardless of Commerce Core configuration, SecurityWeek reported. Drupal assigned the flaw a risk score of 21 out of 25. Drupal credited researchers Dan Puccetti, Marcus Johansson, and Robert Snyder for reporting the flaw. The flaw carries no configuration prerequisites for exploitation.

Drupal said, “The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.” Commerce Core is a module that adds e-commerce functionality to Drupal CMS, handling shopping carts, checkout processes, and API integrations. More than 42,000 websites rely on it, including Fortune 500 companies and research universities.

The vendor recommends upgrading to Commerce Core 3.3.13 for version 3.x or 8.x-2.41 for earlier versions. It also advises auditing orders for inconsistencies because of active exploitation risks. The advisory recommends reviewing store orders for signs of compromise. The advisory emphasizes immediate patching to mitigate active exploitation.

Drupal patched two critical remote code execution flaws, CVE-2026-108097 and CVE-2026-108099, on Oct. 14, 2026, warning that exploits could appear within hours or days. Those flaws required specific contributed modules or custom code for exploitation. Separately, CISA added CVE-2026-9082, a Drupal SQL injection flaw, to its Known Exploited Vulnerabilities Catalog in May 2026. That flaw affected PostgreSQL-backed Drupal sites and carried privilege escalation and remote code execution risks.

CISA has flagged five Drupal vulnerabilities exploited in the wild, including two abused by ransomware gangs. The agency’s Known Exploited Vulnerabilities Catalog includes Drupal flaws under active attack. Drupal did not disclose details on the attackers, exploitation methods, or the number of targeted sites. The vendor stressed immediate patching to mitigate active exploitation.