conv.

All stories
SecurityQuiet 11d · day 13

Drupal Commerce Core Authorization Bypass Actively Exploited

CVE-2026-118539 in Drupal Commerce Core is being exploited in the wild to financially impact online vendors.

newest coverage 11d agosummary written 12d ago6 pieces6 likes & upvotes MastodonNewswires

What to know

  • CVE-2026-118539 in Drupal Commerce Core is a missing authorization bypass actively being exploited to financially impact online vendors; it affects 42,000+ sites.
  • Unauthenticated attackers can exploit the flaw regardless of module configuration to bypass access controls on routes and entity fields.
  • Drupal confirmed active exploitation but has not disclosed specifics on attack methods, threat actors, or number of targeted sites.
  • Store owners must patch to versions 3.3.13 (for 3.x) or 8.x-2.41 (for earlier versions) and audit orders for inconsistencies.

“This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs.”

Drupal, Platform documentation · Drupal advisory via The Hacker News ↗

Drupal Affected platform & issuer of advisoryDan Puccetti, Marcus Johansson, Robert Snyder Security researchers

Drupal Commerce Core Authorization Bypass Actively Exploited
thehackernews.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 2 pieces in 3h at Oct 30, 5 AM; 6 pieces over 13 days (2 articles · 4 posts) Oct 30, 5 AM — 2 pieces · 1 article · 1 post — Mastodon 1, Newswires 1Oct 30, 8 AM — quietOct 30, 11 AM — quietOct 30, 2 PM — 1 piece · 1 post — Mastodon 1Oct 30, 5 PM — quietOct 30, 8 PM — quietOct 30, 11 PM — 1 piece · 1 post — Mastodon 1Oct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — quietOct 31, 11 AM — quietOct 31, 2 PM — 1 piece · 1 post — Mastodon 1Oct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — 1 piece · 1 article — Mastodon 1Nov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — quietNov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quietToday, 7 AM — quietToday, 10 AM — quietToday, 1 PM — quietToday, 4 PM — quietToday, 7 PM — quiet 1
Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 8:40 PM ET
  1. 1

    Drupal urges store owners to audit orders and patch immediately

    Drupal issued guidance for online store operators to update to fixed versions (3.3.13 or 8.x-2.41) and review their store orders for inconsistencies. The advisory emphasizes that unauthenticated attackers can exploit the flaw regardless of module configuration.

    “Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.”
    — Drupal
    1. 1 outlet Drupal Commerce Core Vulnerability Exploited Against Online Stores

      first by SecurityWeek, 12d ago

    • ottoto2017@prattohome.com

      「ハッカーがDrupal Commerce Coreの認証バイパスにおける重大な脆弱性を積極的に悪用 」： # TheHackerNews 「Drupalは、攻撃者が同社のCommerce Coreコンポーネントに存在する「極めて重大な」セキュリティ上の欠陥を悪用していると警告した。 CVE-2026-118539 （CVSSスコア：該当なし） として追跡されているこの脆弱性は、Commerce Coreのバージョン0.0.0から2.41、および3.0.0から3.3.13に影響を与える認証の欠落に関するものです。 Drupalは勧告の中で、…

      ottoto2017@prattohome.comMastodon11d agoview on Mastodon ↗
    1 more of the top 2 · 2 posts in this stretch
    • sambowne@infosec.exchange

      Drupal warns of critical Commerce Core flaw exploited in attacks https://www. bleepingcomputer.com/news/secu rity/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/

      sambowne@infosec.exchangeMastodon11d agoview on Mastodon ↗
    all of them →
  2. background

    Drupal discloses Commerce Core authorization bypass as actively exploited — Drupal published an advisory for CVE-2026-118539, a highly critical missing authorization flaw in Commerce Core affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. The vulnerability allows access bypass on certain routes and entity fields and is confirmed being exploited in the wild, though specifics on exploitation methods or scope remain undisclosed.

What people are saying 0 voices from 0 sites · best of 2 · verbatim