Drupal has warned administrators to patch a critical access bypass in its Commerce Core module — tracked as CVE-2026-118539 — that unauthenticated attackers are exploiting in the wild. The missing-authorisation weakness affects Commerce Core versions through 2.41 and 3.x through 3.3.13; fixes landed in 3.3.13 and 8.x-2.41, and Drupal's 28 October advisory, tagged "highly critical", urges merchants to upgrade immediately and audit orders for inconsistencies "since threat actors are exploiting this vulnerability in attacks". Commerce Core powers storefronts on more than 42,000 websites, including Fortune 500 companies and research universities, and the advisory warns the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor". The flaw arrives weeks after Drupal patched two critical RCE issues (CVE-2026-108097 and CVE-2026-108099) and warned exploits could emerge within days.

• Source article