Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal has disclosed that attackers are actively exploiting a severe flaw in its Commerce Core module, tracked as CVE-2026-118539. The bug stems from insufficient authorization checks on certain routes and entity fields, letting unauthorized users bypass access controls in ways that could cause direct financial harm to store owners. It affects Commerce Core releases from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13; Drupal has not shared technical details of the ongoing attacks. Site operators running the e-commerce module are urged to upgrade immediately — to version 8.x-2.41 for older branches or 3.3.13 for the 3.x line — to close the gap. The issue was reported to Drupal by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder.