Drupal Commerce Core flaw faces active exploitation
Drupal has warned that threat actors are actively exploiting CVE-2026-118539, a highly critical missing-authorization vulnerability in its Commerce Core module. The issue affects Commerce Core versions from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13.
Drupal recommends that sites on the 3.x branch upgrade to Commerce Core 3.3.13. Sites using earlier releases should upgrade to Commerce Core 8.x-2.41. The advisory does not describe the observed attacks or say how broadly the exploitation campaign has spread.
Access controls on commerce routes and fields
Commerce Core provides the functions used to sell goods and services through an included shopping cart and checkout form. It can also support decoupled applications that use APIs. Drupal said the module does not sufficiently protect certain routes and entity fields.
That missing protection can lead to an access bypass and may financially affect the vendor. The advisory classifies the flaw as highly critical, although a CVSS score was not listed for CVE-2026-118539.
Upgrade guidance for affected Drupal sites
Organizations running Drupal Commerce should establish which Commerce Core branch is deployed before applying the update guidance. The affected version ranges include both the 2.x line through 2.41 and the 3.x line through 3.3.13, so version checks are essential before scheduling remediation.
Drupal credited Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the vulnerability. The disclosure arrives while other web application risks are drawing active attention, including the two critical PHP flaws known collectively as PHP2Shell.
Broader exploitation pressure on PHP
PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, each assigned a CVSS score of 9.2. Wiz said that, as of October 25, 52.1% of organizations were significantly affected. Its researchers observed exploit attempts matching public proof-of-concept material, as well as PHP2Shell-branded tools that instead used session poisoning and a separate local file inclusion vulnerability.
Wiz also noted that memory exhaustion by itself is not enough to complete the PHP2Shell exploit chain, because PHP builds, memory limits and worker behavior can interrupt later stages. For businesses operating Drupal Commerce, the immediate implication is to verify the deployed Commerce Core version, apply the designated upgrade, and review the access controls around commerce routes and entity fields.