CVE-2026-118539: Drupal Commerce Core authorization bypass exploited

# CVE-2026-118539: Drupal Commerce Core authorization bypass exploited

https://gcdradar.vercel.app/incidents/cve-2026-118539-drupal-commerce-core-authorization-bypass-ex · AIR-2026-1666 · closed 2026-11-13

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed active exploitation in the wild.
- Fix status: Fix status unknown
- First reported: 2026-10-30
- AI role: No AI role
- Products: Drupal Commerce Core
- CVE ids: CVE-2026-118539

## Summary

Drupal warned that threat actors are actively exploiting a missing authorization vulnerability in its Commerce Core component. The issue affects multiple versions of the shopping cart module.

## What to do

Update Drupal Commerce Core to a secured version or apply vendor mitigations immediately.

## Affected and fixed versions

- Affected: Commerce Core 0.0.0 to 2.41
- Affected: Commerce Core 3.0.0 to 3.3.13

## Latest updates

- 2026-10-30: Drupal Commerce Core Vulnerability Exploited Against Online Stores (https://securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores)
- 2026-10-30: Drupal warns of critical Commerce Core flaw exploited in attacks (https://bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks)
- 2026-10-30: Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw (https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html)

## Sources

- 2026-10-30 The Hacker News: Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
- 2026-10-30 BleepingComputer: Drupal warns of critical Commerce Core flaw exploited in attacks https://bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks
- 2026-10-30 SecurityWeek: Drupal Commerce Core Vulnerability Exploited Against Online Stores https://securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.