Drupal Flags Critical Commerce Core Flaw as Actively Exploited, Urges Immediate Patch

Drupal's security team has issued an urgent advisory confirming that a high‑severity authorization vulnerability in its Commerce Core module – identified as CVE-2026-118539 – is currently being leveraged by threat actors against online retail sites that run on the platform.

The flaw, described as "highly critical" by Drupal, allows unauthenticated users to bypass access controls and perform actions reserved for privileged accounts, such as modifying product listings, processing orders, or even extracting customer data. The advisory notes that exploitation attempts have been observed in the wild, putting any unpatched Drupal Commerce installations at immediate risk.

Commerce Core is a widely adopted extension that powers the e‑commerce capabilities of thousands of Drupal sites, ranging from small boutique stores to large multinational retailers. Because the module integrates directly with the core content management system, a breach can cascade into broader site compromise, potentially affecting the underlying CMS and any other installed modules.

Drupal's response includes the release of a security update that addresses the authorization bypass. The project maintainers recommend that site operators apply the patch without delay and verify that all dependent modules are compatible with the new version. For sites that cannot update immediately, the advisory suggests implementing temporary mitigations such as restricting access to the affected endpoints via web‑application firewalls and tightening role‑based permissions.

Security researchers have observed exploitation patterns that involve crafted HTTP requests targeting the Commerce Core's order‑management APIs. While the exact payloads vary, the common thread is the manipulation of request parameters to gain elevated privileges. This aligns with a broader trend of attackers focusing on supply‑chain components of popular open‑source platforms, where a single vulnerable module can expose a large number of downstream sites.

Industry observers note that the incident underscores the importance of proactive maintenance for open‑source software. Unlike proprietary systems, many open‑source projects rely on community contributions for timely patches, and site owners must stay vigilant about applying updates. Drupal's regular security advisories and its dedicated security mailing list are key resources for administrators seeking to stay ahead of emerging threats.

Looking ahead, Drupal's security team plans to conduct a comprehensive review of the Commerce ecosystem to identify any additional weaknesses that could be exploited in a similar manner. Meanwhile, merchants are urged to audit their installations, confirm that the CVE‑2026‑118539 fix is in place, and monitor logs for any anomalous activity that could indicate a breach attempt.