A highly critical security vulnerability in Drupal Commerce Core is being actively exploited in the wild, putting online stores at risk of unauthorized access and potential financial losses.
Tracked as CVE-2026-118539, the flaw stems from missing authorization checks that allow attackers to bypass access controls on certain routes and entity fields. Drupal has rated the vulnerability 21 out of 25 on its security risk scale.
The vulnerability affects Commerce Core versions below 3.3.13 in the 3.x branch and versions below 8.x-2.41 in the older branch.
Drupal has urged administrators to upgrade immediately and audit recent orders for suspicious changes or inconsistencies. The warning follows reports of fraudulent order attempts targeting affected stores.
Affected site administrators should prioritize patching and review their transaction records for signs of abuse.