Immediate Action Required: Critical Drupal Commerce Core Flaw (CVE-2026-118539) Under Active Attack

A critical access bypass vulnerability, identified as CVE-2026-118539, has been found and is actively exploited in the Drupal Commerce Core module. If your business uses Drupal with the Commerce Core module, you are likely affected and must take immediate action by upgrading to the patched versions to prevent potential financial loss and unauthorized access. Drupal has advised all administrators to update immediately and review order data for any inconsistencies.

What Happened, with Dates

Drupal recently issued a highly critical warning regarding an access bypass vulnerability (CVE-2026-118539) within its Commerce Core module. This flaw stems from a missing authorization weakness, allowing unauthenticated attackers to exploit it in the wild. Drupal’s advisory, published around 2026-10-30, highlighted that this issue could lead to significant financial impact for vendors.

While Drupal has reported active exploitation, it is important to note that CISA's exploitation assessment in the official CVE-2026-118539 record, as last updated on 2026-10-31, currently lists it as 'none'. However, given Drupal's direct warning, immediate action is paramount for any business leveraging this module.

This incident follows other recent high-profile Drupal security issues. In May 2026, Drupal warned of an SQL injection vulnerability (CVE-2026-9082) in its core, which CISA subsequently added to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-05-22, ordering federal agencies to patch by 2026-05-27. This SQL injection issue, which has a CVSS v3.1 score of 9.8 (CRITICAL), could lead to privilege escalation, information disclosure, and remote code execution.

Just two weeks before the Commerce Core advisory, Drupal also patched two other critical remote code execution flaws (CVE-2026-108097 in Drupal core and CVE-2026-108099 in the Entity List module). These vulnerabilities, published on 2026-10-30, also posed a significant risk of remote code execution, with Drupal urging rapid patching due to the speed at which exploits could be developed.

Who is Affected and How to Check

Your business is affected if you operate a website built on the Drupal Content Management System (CMS) and utilize the Commerce Core module for e-commerce functionalities, such as managing a shopping cart or checkout forms. This module is widely used by over 42,000 websites globally.

The vulnerability, CVE-2026-118539, impacts specific versions of the Commerce Core module. To determine if your installation is vulnerable, you must identify the version of the Commerce Core module you are running. This information can typically be found within your Drupal site's administration interface under the 'Modules' section, or by inspecting your codebase directly. If your module version falls within the ranges listed below, you are affected and require an immediate update. VITI Security offers free website vulnerability scanning that can help identify outdated components.

Affected Commerce Core module versions are:

What to Do Now

Immediate patching is the only effective mitigation for this actively exploited vulnerability. Prioritize this update to prevent financial losses and unauthorized access to your e-commerce operations. This is not a situation where temporary workarounds are advised; a direct upgrade is necessary. Consider engaging managed IT services if you lack internal resources.

Beyond patching, Drupal has specifically recommended auditing your orders for inconsistencies. This means reviewing transaction logs, customer data, and financial records for any unauthorized changes, fraudulent orders, or unusual activity that may indicate an exploit has already occurred.

The specific versions to upgrade to are:

How to Spot Exploitation

Given the nature of this access bypass vulnerability in Commerce Core, attackers could manipulate orders or gain unauthorized access to commerce-related data. The primary indicator highlighted by Drupal is inconsistencies in your order data. This requires proactive monitoring of your e-commerce platform's integrity.

Perform the following checks regularly:

Additionally, a robust 24/7 Security Operations Center (SOC) can provide continuous monitoring and rapid response to anomalous activities that may signal exploitation.

What it Means for Small and Mid-size Businesses

For SMBs, especially those in India and the US, running e-commerce sites on Drupal Commerce, this vulnerability represents a critical business risk. The 'access bypass' nature of CVE-2026-118539 means unauthenticated attackers can potentially gain control over critical aspects of your online store, directly impacting your financial stability and customer trust. A single successful exploit could lead to fraudulent transactions, data breaches, and severe reputational damage.

The active exploitation in the wild means that threat actors are actively scanning for and attempting to compromise vulnerable Drupal Commerce sites right now. Delaying patches leaves your business exposed to immediate and severe financial consequences. Unlike larger enterprises with dedicated security teams, SMBs often have limited resources, making them particularly vulnerable targets.

Timely patching is not merely a technical task; it is a fundamental business imperative. Beyond the immediate threat, failing to address such critical vulnerabilities can also have long-term implications for regulatory compliance, such as GDPR, DPDP Act Compliance, or SEC Regulation S-P, depending on your operations. Proactive cybersecurity measures, including regular vulnerability assessments and penetration testing (VAPT), are essential for maintaining a strong security posture. If you need assistance, do not hesitate to contact VITI Security for expert guidance.

Sources