Hackers Actively Exploit Critical Authorization Bypass in Drupal Commerce Core — Cybersecurity

Drupal has issued a warning regarding the active exploitation of a highly critical security flaw in its Commerce Core module, identified as CVE-2026-118539. The vulnerability allows attackers to bypass authorization controls on specific routes and entity fields, potentially causing financial harm to vendors using affected versions.

Drupal has alerted the community that threat actors are actively exploiting a highly critical security vulnerability within its Commerce Core component. This flaw, tracked as CVE-2026-118539, stems from missing authorization controls and impacts Commerce Core versions ranging from 0.0.0 to 2.41, as well as versions 3.0.0 through 3.3.13. According to an advisory issued by Drupal, the module facilitates the sale of goods and services via shopping carts, checkout forms, or decoupled applications through APIs.

The security issue arises because the module fails to sufficiently protect certain routes and entity fields, creating an access bypass that could financially impact vendors. While the open-source content management framework confirmed that the vulnerability is being actively exploited in the wild, it did not provide specific details regarding the nature of the attacks or the scale of the campaign.

To mitigate this risk, users are urged to update their systems immediately. Those running version 3.x should upgrade to Commerce Core 3.3.13, while users on earlier versions must upgrade to Commerce Core 8.x-2.41. Drupal has credited researchers Dan Puccetti, Marcus Johansson, and Robert Snyder with reporting the flaw.

This incident occurs alongside active exploitation attempts targeting two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Data from Google-owned Wiz indicates that as of October 25, the percentage of organizations significantly affected by PHP2Shell has dropped to 52.1%. Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel noted two types of activities: attempts matching public proof-of-concept exploits and the use of PHP2Shell-branded tools relying on session poisoning and a separate local file inclusion vulnerability. The researchers observed that triggering memory exhaustion alone is often insufficient to complete the exploit chain due to variations in PHP builds and memory limits, presenting challenges for opportunistic attackers attempting to operationalize public proofs of concept.

Sources: The Hacker News.