Skip to content
securitytabs

LiveUpdated

Drupal Warns Attackers Are Exploiting Commerce Core Access Flaw in Online Stores

Drupal says attackers are exploiting a flaw in a module that powers shopping carts on Drupal websites, letting them skip permission checks. Organizations running Drupal online stores should check with their developers or host about updating now.

Written by the SecurityTabs AI newsroom from 4 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Drupal warned that threat actors are exploiting a security flaw it rates highly critical in Commerce Core, the module that lets Drupal sites sell goods and services through a shopping cart. The flaw is tracked as CVE-2026-118539 and is a case of missing authorization, meaning the software does not properly check whether a user is allowed to perform an action. [1][2][3]

The Canadian Centre for Cyber Security issued an advisory on October 30 saying that, as of October 28, Drupal was affected, and that open-source reporting indicates the flaw is being exploited in the wild. [4]

Affected versions and severity

The Canadian Centre lists Commerce Core versions prior to 2.41 and 3.0.0 versions prior to 3.3.13 as affected. NVD gives the flaw a CVSS score of 6.5, while Drupal's own advisory rating is highly critical. CISA has not listed it in its Known Exploited Vulnerabilities catalogue. [4][1]

What is not yet known

The available coverage does not say how many sites have been attacked, who is behind the activity, or what attackers do after bypassing the check. No indicators of compromise have been published in the articles reviewed. [1][2][3][4]

Timeline

  1. The Canadian Centre for Cyber Security published advisory AV26-1105 on the flaw. [4]

  2. Drupal warned that attackers were exploiting the Commerce Core access bypass flaw. [1][2]

  3. The Canadian Centre for Cyber Security dated Drupal's exposure to the Commerce Core flaw to this day. [4]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small shops running a Drupal store through an agency or host may be exposed, since Drupal says the flaw is already being exploited. [1][4]

What to do

  1. Ask your web developer or host whether your site uses Drupal Commerce Core and whether it has been updated past the affected versions. [4]
  2. Ask them to read Drupal's security advisory for this flaw. [1]

Mid-size company

A small IT or security team

What to know

Affected are Commerce Core versions prior to 2.41 and 3.0.0 versions prior to 3.3.13, and exploitation has been reported. [4]

What to do

  1. Inventory Drupal sites that use Commerce Core and compare their versions with the affected ranges. [4]
  2. Update Commerce Core following Drupal's advisory and review store orders and accounts for unexpected activity. [1][2]

Large enterprise

A security operations team

What to know

Drupal and the Canadian Centre report in-the-wild exploitation, but no detection indicators have been published in the reviewed coverage. [1][4]

What to do

  1. Identify all Drupal Commerce deployments, including those run by third parties and agencies, and confirm their versions. [4]
  2. Prioritize patching internet-facing stores per Drupal's advisory and review logs since October 28 for unauthorized access. [1][4]

Sources

  1. [1]The Hacker News · Oct 30, 07:45 UTC
    Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flawcontext
  2. [2]BleepingComputer · Oct 30, 10:16 UTC
    Drupal warns of critical Commerce Core flaw exploited in attackscontext
  3. [3]Security Affairs · Oct 31, 09:08 UTC
    Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539context
  4. [4]Canadian Centre for Cyber Security · Oct 30, 15:43 UTC
    Drupal security advisory (AV26-1105)context