Skip to content
Critical Drupal Commerce Core Vulnerability Actively Exploited

Critical Drupal Commerce Core Vulnerability Actively Exploited

First seen 30 Oct 2026, 12:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 12:47 UTC
  • •CVE-2026-118539 is a critical access bypass vulnerability in Drupal's Commerce Core module.
  • •The flaw is actively exploited, affecting over 42,000 sites and allowing unauthenticated access.
  • •Administrators must update to patched versions immediately and audit store orders for inconsistencies.

Drupal has issued a warning about a highly critical access bypass vulnerability in its Commerce Core module, tracked as CVE-2026-118539. This flaw affects over 42,000 sites and allows unauthenticated attackers to bypass access controls, potentially leading to significant financial impacts for vendors. The vulnerability is actively being exploited in the wild, although specific details about the attacks remain undisclosed. Administrators are urged to update to patched versions 3.3.13 or 8.x-2.41 and to audit their store orders for inconsistencies. Drupal's security team rated the risk as 21 out of 25. The vulnerability affects versions 3.x prior to 3.3.13 and 8.x prior to 8.x-2.41. This incident coincides with the release of additional advisories addressing other critical vulnerabilities in Drupal's ecosystem.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-20
CVE-2026-9082 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-15
Public exploit for CVE-2026-108097 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-30
CVE-2026-118539 published
Drupal disclosed a critical access bypass vulnerability affecting Commerce Core versions 3.x and 8.x.
Securityweek
2026-10-30
CVE-2026-108099 published
Another critical vulnerability was disclosed alongside CVE-2026-118539, affecting Drupal's core modules.
Securityweek
2026-10-30
Active exploitation confirmed
Drupal confirmed that the vulnerability is being actively exploited in the wild, urging immediate patching.
Thehackernews

More articles in this cluster (8)

Following this threat?

Track CVE-2026-108097 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

Which versions of Commerce Core are affected?
The vulnerability affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
What should I do if my site is affected?
Immediately update to Commerce Core version 3.3.13 or 8.x-2.41 to mitigate the risk.
Is there evidence of exploitation?
Yes, Drupal has confirmed that the vulnerability is actively being exploited in the wild.