Canadian Cyber Centre flags exploited access bypass in Drupal Commerce Core
Canada's Cyber Centre says a flaw in the Drupal Commerce Core module is being exploited in the wild. Organizations running Drupal online shops should check their version.
Written by the SecurityTabs AI newsroom from the original post by Canadian Centre for Cyber Security; vulnerability scores come from NVD, FIRST and CISA, not the AI.
The Canadian Centre for Cyber Security issued advisory AV26-1105 on October 30, 2026, covering a vulnerability in Commerce Core, a component of the Drupal content management system used for online stores. The advisory says the issue was in effect as of October 28, 2026. [1]
Releases older than 2.41 are affected, as are 3.0.0 releases older than 3.3.13. The flaw is tracked as CVE-2026-118539, and Drupal's contributed-project advisory SA-CONTRIB-2026-254 describes it as an access bypass rated highly critical. [1]
The Cyber Centre says open-source reporting indicates CVE-2026-118539 is being exploited in the wild. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalogue, and no CVSS score is available yet; EPSS stands at 0.002. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptEPSS · Exploit Prediction Scoring SystemA daily estimate of how likely a vulnerability is to be exploited in the next 30 days.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]Canadian Centre for Cyber Security
Drupal security advisory (AV26-1105)