Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
- Severity
- High
- Highest CVSS
- 6.5
- Exploited
- Yes
- Sources
- 4
What happened
CVE-2026-118539 (advisory SA-CONTRIB-2026-254) is a missing authorization issue in Drupal Commerce Core caused by insufficient protection of certain routes and entity fields. Affected versions are those before 2.41 and 3.0.0 up to but not including 3.3.13; Drupal rates it 21/25 (highly critical), unauthenticated and affecting all configurations, with possible exposure of some private data and modification of some data. Drupal confirms in-the-wild exploitation, but the advisory does not give the attack method, affected fields, victims or volumes, and does not establish remote code execution; one outlet's claim of $0.01 purchases is not confirmed by Drupal. Defenders should upgrade to 2.41 or 3.3.13, noting this is a Commerce module update separate from Drupal core releases, and reconcile orders with expected prices and payment records.
For security analysts · Written by AI from 4 sources · Wrong?
What to do
- CVE-2026-9082 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use Drupal Core: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 6 updates
- Fri 22 MayCVE-2026-9082 added to CISA’s exploited listCISA KEV
- Fri 30 OctoberCVE-2026-118539 published, CVSS 6.5NVD
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawThe Hacker News
- Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01Cyber Security News
- Drupal security advisory (AV26-1105)Canadian Centre for Cyber Security
- Sat 31 OctoberAttackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539Security Affairs