Drupal has warned that attackers are already exploiting CVE-2026-118539, a “highly critical” missing-authorization flaw in the Drupal Commerce Core module. The advisory, published October 29, gives no detail on who is behind the attacks or how many sites have been hit.
What CVE-2026-118539 Does Inside Drupal Commerce Core
CVE-2026-118539 is a missing-authorization vulnerability. Drupal says the Commerce Core module does not sufficiently protect certain routes and entity fields, which produces an access bypass. The advisory states the flaw “may financially impact the vendor,” a phrase that points to merchants running online stores on the module rather than to end customers.
No CVSS score has been assigned to the flaw. Drupal nonetheless rates it “highly critical” and acknowledges that it is being “actively exploited in the wild.” The project has not described the activity, the scale of the attacks or the methods attackers are using to reach the unprotected routes.
Affected Commerce Core Version Ranges
Two version ranges are affected: Commerce Core 0.0.0 through 2.41, and 3.0.0 through 3.3.13. Drupal’s remediation guidance is to update to the latest Commerce Core release. The advisory does not list a separate workaround.
Researchers Credited With Reporting the Flaw
Drupal credited three reporters: Dan Puccetti, Marcus Johansson and Robert Snyder. The advisory does not say when they reported the issue or how long exploitation has been under way, so the interval between the first attacks and the public warning is unknown.
Exploitation Is Confirmed but Victim Counts Are Not
Because Drupal gave no figures, the number of compromised stores cannot be determined from the advisory. Online stores running vulnerable Commerce Core versions could have access controls bypassed, with a potential financial effect on merchants. Drupal has not said whether attackers have changed orders, prices, payment settings or customer records, and it has not published indicators of compromise.
The lack of detail leaves site operators to assess their own exposure by checking which Commerce Core version they run against the two affected ranges. Sites on 2.41 or earlier, or on any 3.x release up to 3.3.13, fall inside the vulnerable window.
PHP2Shell Flaws Still Draw Exploitation Attempts
The Drupal warning arrived alongside separate context about a different set of flaws. The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and continue to see exploitation attempts. Wiz reported that the share of organizations significantly affected had fallen to 52.1% as of October 25.
That figure indicates the PHP2Shell flaws remained a live problem for a majority of exposed organizations even as the proportion declined. The Drupal Commerce advisory is a separate matter, and Drupal has not linked the two campaigns.
Why the Missing Details Matter for Merchants
Drupal’s advisory leaves several questions open: the nature of the exploitation, the number of affected stores, and whether attackers are targeting specific merchants. Until Drupal or the credited researchers publish more information, the confirmed facts are limited to the version ranges, the access-bypass behavior and the statement that exploitation is occurring now. The absence of a CVSS score also means automated vulnerability scanners that rank findings by score may not flag the issue at the priority Drupal’s own “highly critical” label implies.
Drupal’s Advisory Confirms Four Facts and Leaves Others Open
The advisory establishes that the flaw is a missing-authorization issue, that it affects two Commerce Core version ranges, that exploitation is occurring and that a fix exists in the latest Commerce Core release. It does not establish who is exploiting the flaw, how many stores have been affected, or what attackers do after bypassing the access controls.
Drupal says protection gaps cover both certain routes and certain entity fields, which means access checks fell short at two distinct points in the module. The advisory words the consequence as a possible financial impact on the vendor, and it attaches no CVSS score to the “highly critical” label.
