Drupal warns of critical Commerce Core flaw exploited in attacks

Drupal has issued an urgent advisory for a critical access-bypass vulnerability in its Commerce Core module, which is already being leveraged by attackers. The flaw, catalogued as CVE-2026-118539, arises from inadequate authorization checks on certain routes and entity fields, letting unauthenticated attackers bypass protections — potentially causing financial harm to site owners. It impacts Commerce Core releases from 0.0.0 up to 2.41 and from 3.0.0 up to 3.3.13. The Drupal security team is urging administrators to upgrade right away to version 3.3.13 (or 8.x-2.41 for older installs) and to review order histories for signs of tampering, given the module's use on more than 42,000 sites, including large enterprises and universities.