Emerging Threats

Drupal patches Commerce Core flaw under active exploitation

Analyst 207||Source: BleepingComputer
E-commerce website backend on laptop with retail store background.

CVE-2026-118539: a missing authorization check in the widely used Commerce Core module is being exploited in the wild, Drupal warned, and administrators were told to upgrade immediately.

CVE-2026-118539: what the flaw is and how it is being used

Drupal's security team described CVE-2026-118539 as an access bypass that stems from "a missing authorization weakness" and can be abused by unauthenticated attackers. The vulnerability affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal said the issue "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor," and explicitly added that "this vulnerability is being actively exploited in the wild."

Drupal's immediate mitigation: upgrade and audit orders

Drupal asked administrators on the 3.x branch to "upgrade immediately to Commerce Core 3.3.13 (or Commerce Core 8.x-2.41 for earlier versions)" and to audit orders for inconsistencies, since threat actors are already exploiting the flaw. The advisory, posted on a Wednesday and tagged as highly critical, also reminded site owners of the module's purpose: "This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs."

Scope: how many sites and who could be affected

Commerce Core is a community-developed Drupal module installed on more than 42,000 websites. Drupal's advisory noted that those sites include "many high-profile organizations such as Fortune 500 companies and research universities." The module provides a framework for building and running e-commerce sites and shopping apps atop the Drupal content management system, meaning a successful exploit can directly affect checkout and order-handling functionality.

Related recent Drupal vulnerabilities and federal response

The Commerce Core advisory follows a string of recent Drupal security events. In May, Drupal warned that attackers were exploiting an SQL injection vulnerability in the database abstraction API, tracked as CVE-2026-9082; days later the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added that flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch within three days. Two weeks ago, Drupal patched two remote code execution issues — CVE-2026-108097 and CVE-2026-108099 — and urged administrators to apply updates "as soon as possible" because attackers could develop exploits "within hours or days." Over the last several years, CISA has flagged five Drupal vulnerabilities that were exploited in the wild, two of which were also abused by ransomware gangs.

What this means for technologists, CISA and federal agencies, and e-commerce site owners

  • Technologists and security teams: apply the stated upgrades immediately (3.3.13 for 3.x sites or 8.x-2.41 for earlier branches) and audit recent orders for anomalies, since the advisory links the flaw to financial impact on vendors.
  • CISA and federal agencies: the May precedent — CVE-2026-9082 being added to the KEV Catalog and subject to a three-day patch directive — underscores how quickly exploit-driven Drupal flaws can trigger mandatory remediation steps for federal systems.
  • E-commerce site owners, including large enterprises and universities: because Commerce Core underpins checkout and API-driven commerce flows, site operators should verify their Commerce Core version, apply the update, and review transaction logs or order records for signs of manipulation or unauthorized activity.

Defensive context: prevention scores and post-access risk

The advisory sits against a broader defensive picture: the Blue Report 2026 — cited in the advisory material — measures defenses technique-by-technique across 338 million simulations in customer production environments and warns that "overall prevention scores can hide what happens after initial access." The report notes that "once attackers are using valid credentials, prevention drops sharply," a reminder that patching and auditing must be paired with monitoring for anomalous account activity and post-compromise behavior.

The immediate fact is simple and urgent: a critical authorization bug in a commerce module used by tens of thousands of sites is being exploited now, and Drupal's recommended upgrades and order audits are the frontline response. Whether operators move quickly will determine how many storefronts and buyer transactions are affected; the advisory, recent KEV action, and the Blue Report's simulations collectively make clear that rapid patching and investigation are not optional.

Original story: https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/

Active ExploitationE-CommerceEmerging ThreatsWeb Application SecurityDrupalMissing AuthorizationCommerce CoreCVE-2026-118539Access Bypass
Related Intelligence

Continue Reading

Cluttered developer workspace with laptop and monitor, surrounded by coffee cups and notes near a window.

Malware Infects 5,000 via Compromised VS Code Extension

A malicious VS Code extension infected up to 5,000 users after the Cursor Marketplace was compromised, putting their systems at risk. The malware has since been removed and affected users will be contacted directly.

Analyst 207
Laptop on cluttered workbench with blurred screen and city view through window.

Binance Crypto Heist Traced to North Korean Hackers

Binance's investigation reveals that the massive crypto heist, valued at $6.3 billion, was a sophisticated attack involving a compromised DevOps laptop and unauthorized access to a service container, rather than a simple one-click exploit. The exchange is still gathering facts, but has found no evidence of a leaked wallet private key.

Analyst 207
Retail checkout counter with terminal, cashier, and everyday shopping items.

Drupal Flaw Exploited Actively in Wild

Drupal warns of a highly critical flaw in its Commerce Core component that's already being exploited in the wild, allowing unauthorized access that could have serious financial implications. This vulnerability affects Commerce Core releases from 0.0.0 to 2.41 and 3.0.0 to 3.3.13.

Analyst 207
Rows of computer servers and development workstations in a brightly-lit software development room with network devices in…

CISA Flags Actively Exploited GitLab, Cisco Flaws

CISA is sounding the alarm on two critical vulnerabilities, CVE-2026-97229 and CVE-2026-76418, after evidence revealed they're being actively exploited by hackers, putting organizations and federal agencies at risk. These flaws, particularly the severe CVE-2026-97229 with a 10.0 CVSS score, demand priority attention to prevent devastating attacks.

Analyst 207