Drupal has issued a warning about a significant security vulnerability within its Commerce Core module, which is currently being exploited by malicious actors. The flaw, identified as CVE-2026-118539, affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, posing a potential risk due to insufficient authorization checks.
Understanding the Vulnerability
This critical issue stems from inadequate protection of specific routes and entity fields within the Commerce Core module. The module, designed to facilitate online sales through a shopping cart and API integration, is now vulnerable to unauthorized access, potentially impacting vendors financially.
Drupal has acknowledged the active exploitation of this flaw but has yet to disclose specific details regarding the nature or scope of these activities. The organization has strongly recommended users to upgrade to the latest versions to mitigate the risk.
Recommended Actions for Users
To address the vulnerability, users should update to Commerce Core 3.3.13 for version 3.x or to Commerce Core 8.x-2.41 for earlier versions. Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder have been credited for identifying this flaw.
In conjunction with this update, users should review their security protocols and ensure they are following best practices to protect their systems from unauthorized access.
Broader Security Concerns
This development coincides with ongoing exploitation attempts of two critical PHP vulnerabilities, collectively known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have a high CVSS score of 9.2 and are actively being targeted in the wild.
According to Wiz, a cloud security firm, the percentage of organizations affected by PHP2Shell has decreased to 52.1% as of late October. The firm notes two primary exploit mechanisms: one using known proof-of-concept tools and another involving session poisoning and a local file inclusion vulnerability.
Wiz researchers emphasize that exploiting these vulnerabilities requires more than just triggering memory exhaustion. Variations in PHP builds and configurations can disrupt the exploit chain, presenting a challenge for attackers to develop reliable tools.
As cybersecurity threats continue to evolve, it is crucial for organizations to remain vigilant and proactive in updating and securing their systems to protect against potential exploits.
