"The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor," Drupal warned, describing a "highly critical" authorization flaw in its Commerce Core component that the project says is already being exploited in the wild.
CVE-2026-118539: missing authorization in Commerce Core
Drupal has assigned CVE-2026-118539 to a missing-authorization vulnerability that affects Commerce Core releases from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. The vendor described Commerce Core as the module that "enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs." In its advisory Drupal said the flaw allows an access bypass by failing to sufficiently protect certain routes and entity fields.
Drupal also acknowledged that the vulnerability is "actively exploited in the wild," but the advisory provided no specifics about the nature or scale of the observed activity. Drupal credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) with reporting the issue.
Patch guidance: which versions to upgrade to
Drupal published immediate upgrade guidance. Users on the 3.x line are told to upgrade to Commerce Core 3.3.13. Those on earlier branches are told to upgrade to Commerce Core 8.x-2.41. Drupal's advisory presents those updates as the remedy to the authorization bypass.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildConcurrent exploitation activity: PHP2Shell and the larger threat environment
The Commerce Core advisory arrives amid active exploitation attempts tied to two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — collectively referred to in reporting as PHP2Shell and assigned CVSS scores of 9.2. The cloud security company Google-owned Wiz reported seeing active attempts, and provided metrics and characterization of activity as of October 25.
Wiz said the percentage of organizations "significantly affected" by PHP2Shell had declined to 52.1% as of October 25. The company reported observing two activity types: attempts that use the PHP2Shell exploit mechanism and match publicly available proof-of-concept (PoC) exploits, and a second category of "PHP2Shell-branded tools" that do not exploit those PHP vulnerabilities but instead rely on session poisoning and a separate local file inclusion (LFI) vulnerability in the application.
Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel noted a technical constraint that shapes attacker success: "Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits and worker behavior can prevent subsequent stages from working. The challenge for opportunistic attackers is turning currently available public PoCs into similarly reliable operational tooling or developing it on their own."
What this means for e-commerce operators, security teams, and vendors
- E-commerce operators: Sites that use Commerce Core should treat the advisory as actionable evidence that an authorization bypass exists and that Drupal reports active exploitation. Drupal's recommended target versions — Commerce Core 3.3.13 for 3.x users and Commerce Core 8.x-2.41 for earlier users — are cited as the remedial step in the advisory.
- Security teams and technologists: The presence of active exploitation and contemporaneous PHP2Shell activity means defenders face multiple, distinct vectors. Wiz's analysis highlights that public PoCs may not reliably convert into operational exploits across environments, but both matched-PoC attempts and unrelated "PHP2Shell-branded" tools are being observed.
- Vendors and site owners: Drupal's explicit warning that the authorization bypass "may financially impact the vendor" foregrounds the commercial stakes for organizations processing payments and orders through Commerce Core.
Final assessment
Drupal's advisory identifies a concrete authorization bypass — CVE-2026-118539 — in Commerce Core, names the vulnerable version ranges, credits three external reporters, and recommends immediate upgrades to specific releases. At the same time, the advisory confirms active exploitation without offering operational detail, while the broader threat picture includes active attempts against two critical PHP flaws tracked as PHP2Shell and quantified by Wiz's October 25 data. The record that Drupal published points to a clear mitigation path — the targeted Commerce Core upgrades — and leaves open the question of the scope and mechanics of the active exploitation that Drupal acknowledged.
