According to The Hacker News, hackers are actively exploiting a highly critical security flaw in Drupal’s Commerce Core component. Drupal has issued a warning that threat actors are currently using the vulnerability.
The issue involves missing authorization controls and affects Commerce Core versions ranging from 0.0.0 to 2.41 as well as versions from 3.0.0 to 3.3.13. The flaw is tracked under CVE-2026-118539; a CVSS score has not been assigned.
Commerce Core includes functionality for selling goods and services to customers via an integrated shopping cart system. Due to the missing authorization, unauthorized users may be able to access or manipulate commerce functions outside their permitted permissions.
Drupal recommends that affected site operators review implementation practices related to user access controls in Commerce Core and apply updates if available. No further details on exploitation frequency, target environments, or mitigation steps beyond standard advisory guidance were provided in the source material.
