The warning

Drupal has warned owners of online stores built on its Commerce Core module to update immediately, after confirming that a highly critical access-bypass flaw is being exploited in the wild.

The flaw, tracked as CVE-2026-118539, affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Drupal describes it as a missing-authorisation weakness: the module does not sufficiently protect certain routes and entity fields, allowing an access bypass that may financially affect the vendor. Drupal rates it 21 out of 25 on its own risk scale and says unauthenticated attackers can exploit it regardless of how the module is configured.

What store owners should do now

Stores on the 3.x line should upgrade to Commerce Core 3.3.13. Stores on the older line should upgrade to 8.x-2.41. Updating Drupal core alone does not fix the problem, because Commerce Core is a separate module with its own version number.

Drupal also tells administrators to audit their orders for inconsistencies. That step matters because a bypass affecting carts and checkout could produce orders that do not match the payments behind them. Reports from merchants cited in follow-up coverage described orders that did not add up, including at least one priced at $0.01, although ordinary-looking prices could also hide a problem, so a scan for cheap orders alone is not enough.

What is still unknown

Drupal has confirmed active exploitation but has not named an attacker, counted the affected stores, or put a figure on losses. The 42,000-plus figure is the number of sites using Commerce Core, not the number attacked. Store owners should therefore treat an affected version as a reason to patch and check orders promptly, not as proof that their own store was breached.

Sources: The Hacker News